CVE-2025-54781 Himmelblau leaks an Intune service access token in its logs
Attackers with log access can steal Intune service tokens to view compliance status and potentially perform administrative operations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-54781?
CVE-2025-54781 is a low-severity vulnerability in himmelblau-idm himmelblau, published on 1 Aug 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the host's Intune compliance status, and may permit additional administrative operations for the Intune host device (though the API for these operations is undocumented). This is fixed in version 1.1.0. To workaround this issue, ensure that Himmelblau debugging is disabled.
Weakness: CWE-532
Which versions are affected by CVE-2025-54781?
How do I fix CVE-2025-54781?
No fix has been published for CVE-2025-54781 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-54781 being exploited?
There is no known exploitation of CVE-2025-54781 in the wild and no public exploit code.
Sources
Also known as GHSA-78qg-vmrw-574w.