CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage
Attackers can hijack an unclaimed S3 bucket to intercept logs containing sensitive tokens and keys, enabling cross-tenant data leakage and user impersonation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34064?
CVE-2025-34064 is a critical vulnerability in OneLogin Active Directory Connector (ADC), published on 1 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.
Which versions are affected by CVE-2025-34064?
How do I fix CVE-2025-34064?
No fix has been published for CVE-2025-34064 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34064 exists.
Sources
Also known as GHSA-p59x-w56c-2jj2.