Log in Start free

One Identity

Products

ProductCVEsExploitedLatest
OneLogin Active Directory Connector (ADC)3–Jul 1, 2025
OneLogin2–Sep 14, 2025
Password Manager1–Jul 14, 2025

Exploited and recent CVEs

  • CVE-2025-59363 High 7.7 In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created), 0.3%
  • CVE-2025-52924 Medium 4.0 In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header. 0.3%
  • CVE-2025-27582 High 7.6 The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser use 0.2%
  • CVE-2025-34064 Critical 9.0 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage 0.5%
  • CVE-2025-34063 Critical 10.0 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key 0.6%
  • CVE-2025-34062 Medium 5.7 OneLogin AD Connector API Credential and Signing Key Exposure 0.2%