One Identity vulnerabilities
We track 4 vulnerabilities in One Identity products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2025.
Latest One Identity vulnerabilities
- 7.7 High severity
OneLogin: Incorrect Resource Transfer Between Spheres
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),
- 7.6 High severity
Password Manager: Inclusion of Functionality from Untrusted Control Sphere
The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Sp
- 9.0 Critical severity
OneLogin Active Directory Connector (ADC): Exposure of Sensitive Information to an Unauthorized Actor
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log
- 10.0 Critical severity
OneLogin Active Directory Connector (ADC): Authentication Bypass by Spoofing
A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JW