CVE-2025-34062 OneLogin AD Connector API Credential and Signing Key Exposure
An attacker with a valid directory token can retrieve sensitive credentials and signing keys from the OneLogin AD Connector API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34062?
CVE-2025-34062 is a medium-severity vulnerability in OneLogin Active Directory Connector (ADC), published on 1 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.
Which versions are affected by CVE-2025-34062?
How do I fix CVE-2025-34062?
No fix has been published for CVE-2025-34062 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34062 being exploited?
There is no known exploitation of CVE-2025-34062 in the wild and no public exploit code.
Sources
Also known as GHSA-mq9j-59r5-qmvh.