Bypass of OTP in Quest One Identity 7.5.1.20903
CVE-2025-56689

4.6MEDIUM

Key Information:

Vendor

Quest Software

Status
Quest One Identity
Vendor
CVE Published:
3 September 2025

What is CVE-2025-56689?

A security flaw has been identified in Quest One Identity version 7.5.1.20903 that allows an attacker to manipulate crafted responses. This manipulation can circumvent the One-Time Password (OTP) requirement on the Multi-Factor Authentication (MFA) page, enabling unauthorized access to the Privileged Access Management (PAM) portal. Consequently, attackers can potentially gain control over arbitrary accounts, posing a serious risk to sensitive data and system integrity.

References

https://medium.com/@vigneshrajan54_88115/how-i-found-cve-...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.