One Identity Onelogin Active Directory Connector vulnerabilities

CVE-2025-34063 [CRITICAL] CWE-290 CVE-2025-34063: A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 d A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authent

CVE-2025-34064 [CRITICAL] CWE-200 CVE-2025-34064: A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directo

CVE-2025-34062 [MEDIUM] CWE-200 CVE-2025-34062: An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include