One Identity OneLogin

• CVE-2025-59363 High 7.7 In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created), 0.3%
• CVE-2025-52924 Medium 4.0 In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header. 0.3%