Unauthorized Access Vulnerability in JumpServer by JumpServer

CVE-2025-62712

What is CVE-2025-62712?

JumpServer, an open-source bastion host and operational security audit solution, has an access control vulnerability where authenticated, non-privileged users can retrieve connection tokens of other users via the super-connection API endpoint. This endpoint improperly exposes all users' connection tokens instead of restricting access to those owned or authorized for the requesting user. Consequently, an attacker can leverage these tokens to establish connections to managed assets on behalf of the original owners, potentially leading to unwanted access and privilege escalation within critical systems. The issue has been resolved in versions v3.10.20-lts and v4.10.11-lts.

References