Cryptographic Authentication Bypass in OneLogin AD Connector
CVE-2025-34063

10CRITICAL

Key Information:

Vendor

One Identity

Status
Onelogin Active Directory Connector (adc)
Vendor
CVE Published:
1 July 2025

What is CVE-2025-34063?

A vulnerability in the OneLogin AD Connector exposes a tenant’s SSO JWT signing key through the /api/adc/v4/configuration endpoint, allowing attackers to craft valid JWT tokens. This enables them to impersonate any user within a OneLogin tenant, leading to unauthorized access to not only the OneLogin SSO portal but also all downstream applications integrated through SAML or OIDC. The breach poses significant security risks to the affected SaaS environment, as it can facilitate full user impersonation and data exploitation.

Affected Version(s)

OneLogin Active Directory Connector (ADC) 0 < 6.1.5

References

https://support.onelogin.com/product-notification/noti-00...
vendor-advisorypatch
https://specterops.io/blog/2025/06/10/onelogin-many-issue...
technical-description
https://vulncheck.com/advisories/onelogin-ad-connector-ac...
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SpecterOps
.
CVE-2025-34063 : Cryptographic Authentication Bypass in OneLogin AD Connector