Skip to content
OpenAdvisories

Vendor

One Identity

7 known vulnerabilities.

One Identity at a glance

Last 12 months
0
Critical · all time
3
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202552
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202511
Dec 202400

Products

OneLogin Active Directory Connector (ADC) 3 OneLogin 2 Password Manager 1 Identity Manager 1
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.7
    CVE-2025-59363

    In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though th…

    One Identity OneLogin
  • Medium 4.0
    CVE-2025-52924

    In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrust…

    One Identity OneLogin
  • High 7.6
    CVE-2025-27582

    The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The iss…

    One Identity Password Manager
  • Critical 9.0
    CVE-2025-34064

    OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

    A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving lo…

    One Identity OneLogin Active Directory Connector (ADC)
  • Critical 10.0
    CVE-2025-34063

    OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

    A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid J…

    One Identity OneLogin Active Directory Connector (ADC)
  • Medium 5.7
    CVE-2025-34062

    OneLogin AD Connector API Credential and Signing Key Exposure

    An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secur…

    One Identity OneLogin Active Directory Connector (ADC)
  • Critical 9.9
    CVE-2024-56404

    In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privil…

    One Identity Identity Manager