CVE-2025-59363
BaseFortify
Publication date: 2025-09-14
Last updated on: 2025-09-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oneidentity | onelogin | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-669 | The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in One Identity OneLogin before version 2025.3.0 causes the OIDC client secret to be returned by the GET Apps API v2 request, even though this secret should only be returned when an App is first created. This means that the client secret, which is sensitive information, can be exposed unintentionally through an API call.
How can this vulnerability impact me? :
The exposure of the OIDC client secret can lead to unauthorized access or misuse of the affected application, as the secret is intended to be confidential. Attackers or unauthorized users who obtain this secret could potentially impersonate the application or gain elevated access, leading to a compromise of security.