Skip to content
OpenAdvisories
Medium · 5.7 CVE-2025-25207 EUVD-2025-17430GHSA-r8xr-pgv5-gxw3GO-2025-3746

Rhcl: authpolicy callbacks result in denial of service in authorino severity

Published Jun 9, 2025 · Updated Nov 6, 2026 · Assigned by redhat

Description

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.

Affected products

VendorProductAffectedFixed
— rhcl-operator-container 1.0.1 —
Red Hat Red Hat Connectivity Link 1 — —
Red Hat Red Hat OpenShift AI (RHOAI) — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250612T141001-1.1 openSUSE-SU-2025:15225-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/kuadrant/authorino <= 0.20.0 — GHSA-r8xr-pgv5-gxw3
Go github.com/kuadrant/authorino all versions — GO-2025-3746

Advisories 1

References