Vulnerability · Published Jul 1, 2025 · Assigned by VulnCheck

CVE-2025-34062OneLogin AD Connector API Credential and Signing Key Exposure

Medium 5.7

In plain English

A medium-severity information exposure in OneLogin Active Directory Connector (ADC) from One Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)5.7Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.

Affected products (as reported)

Vendor	Product	Versions
One Identity	OneLogin Active Directory Connector (ADC)	0 – before 6.1.5

Weakness: CWE-200, CWE-522 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://support.onelogin.com/product-notification/noti-00001768 vendor-advisory, patch
https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/ technical-description
https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise third-party-advisory