SQL Injection Vulnerability in One Identity OneLogin
CVE-2025-52924

4MEDIUM

Key Information:

Vendor

One Identity

Status
Onelogin
Vendor
CVE Published:
19 July 2025

What is CVE-2025-52924?

A vulnerability exists in One Identity's OneLogin platform where the SQL connection 'application name' is improperly configured. It is set based on the value of an untrusted X-RequestId HTTP request header, which could allow attackers to manipulate this input and execute unauthorized SQL queries. This poses significant risks to database security, potentially leading to data breaches or loss of integrity in the application environment.

Affected Version(s)

OneLogin 0 < 2025.2.0

References

https://oneidentity.com
https://onelogin.service-now.com/support?id=kb_article&sy...

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52924 : SQL Injection Vulnerability in One Identity OneLogin