A high-severity safety flaw has been disclosed within the One Id OneLogin Id and Entry Administration (IAM) answer that, if efficiently exploited, may expose delicate OpenID Join (OIDC) software consumer secrets and techniques beneath sure circumstances.
The vulnerability, tracked as CVE-2025-59363, has been assigned a CVSS rating of seven.7 out of 10.0. It has been described as a case of incorrect useful resource switch between spheres (CWE-669), which causes a program to cross safety boundaries and procure unauthorized entry to confidential information or features.
CVE-2025-59363 “allowed attackers with legitimate API credentials to enumerate and retrieve consumer secrets and techniques for all OIDC functions inside a corporation’s OneLogin tenant,” Clutch Safety mentioned in a report shared with The Hacker Information.
The id safety mentioned the issue stems from the truth that the applying itemizing endpoint – /api/2/apps – was configured to return extra information than anticipated, together with the client_secret values within the API response alongside metadata associated to the apps in a OneLogin account.
The steps to tug off the assault are listed beneath –
- Attacker makes use of legitimate OneLogin API credentials (consumer ID and secret) to authenticate
- Request entry token
- Name the /api/2/apps endpoint to listing all functions
- Parse the response to retrieve consumer secrets and techniques for all OIDC functions
- Use extracted consumer secrets and techniques to impersonate functions and entry built-in providers
Profitable exploitation of the flaw may enable an attacker with legitimate OneLogin API credentials to retrieve consumer secrets and techniques for all OIDC functions configured inside a OneLogin tenant. Armed with this entry, the risk actor may leverage the uncovered secret to impersonate customers and acquire entry to different functions, providing alternatives for lateral motion.
OneLogin’s role-based entry management (RBAC) grants API keys broad endpoint entry, that means the compromised credentials could possibly be used to entry delicate endpoints throughout all the platform. Compounding issues additional is the shortage of IP tackle allowlisting, because of which it is attainable for attackers to use the flaw from anyplace on this planet, Clutch famous.
Following accountable disclosure on July 18, 2025, the vulnerability was addressed in OneLogin 2025.3.0, which was launched final month by making OIDC client_secret values now not seen. There isn’t a proof that the problem was ever exploited within the wild.
“Id suppliers function the spine of enterprise safety structure,” Clutch Safety mentioned. “Vulnerabilities in these methods can have cascading results throughout complete know-how stacks, making rigorous API safety important.”
