CVE-2025-25207 Rhcl: authpolicy callbacks result in denial of service in authorino severity
An attacker with developer persona access can cause a Denial of Service in Authorino by adding excessive post-authorization callbacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25207?
CVE-2025-25207 is a medium-severity denial of service vulnerability in Red Hat Connectivity Link 1, published on 9 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.
Weakness: CWE-770
Which versions are affected by CVE-2025-25207?
3 open source packages ship an affected version, including github.com/kuadrant/authorino.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kuadrant/authorino Go | All versions | None |
github.com/kuadrant/authorino Go | All versions to 0.20.0 | None |
github.com/kuadrant/authorino Go | All versions to 0.20.0 | None |
How do I fix CVE-2025-25207?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-25207 being exploited?
There is no known exploitation of CVE-2025-25207 in the wild and no public exploit code.
Sources
Also known as GHSA-r8xr-pgv5-gxw3, GO-2025-3746.