OneLogin Active Directory Connector (ADC) vulnerabilities

2 known vulnerabilities in OneLogin Active Directory Connector (ADC) from One Identity. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  OneLogin Active Directory Connector (ADC): Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-34064Jul 1, 2025One Identity

  A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log

• 10.0 Critical severity

  OneLogin Active Directory Connector (ADC): Authentication Bypass by Spoofing

  CVE-2025-34063Jul 1, 2025One Identity

  A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JW