Skip to content
OpenAdvisories

Vendor

One Identity

7 known vulnerabilities.

Products

OneLogin Active Directory Connector (ADC) 3 OneLogin 2 Password Manager 1 Identity Manager 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.0
    CVE-2025-34064

    OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

    A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving lo…

    One Identity OneLogin Active Directory Connector (ADC)
  • Critical 10.0
    CVE-2025-34063

    OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

    A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid J…

    One Identity OneLogin Active Directory Connector (ADC)
  • Critical 9.9
    CVE-2024-56404

    In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privil…

    One Identity Identity Manager