Vulnerability · Published Jul 1, 2025 · Assigned by VulnCheck

CVE-2025-34063OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

Critical 10.0

In plain English

A critical-severity authentication bypass by spoofing in OneLogin Active Directory Connector (ADC) from One Identity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.6%top 50.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

Affected products (as reported)

Vendor	Product	Versions
One Identity	OneLogin Active Directory Connector (ADC)	0 – before 6.1.5

Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://support.onelogin.com/product-notification/noti-00001768 vendor-advisory, patch
https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/ technical-description
https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise third-party-advisory