Skip to main content

Incorrect Resource Transfer Between Spheres

CVE-2025-59363

High
7.7/10

Summary

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-669 - Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References

Advisory Timeline

  • Published