CVE-2025-56689 Auth bypass in n/a
Attackers can bypass OTP verification by replaying intercepted responses, though the vendor disputes this as intended behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-56689?
CVE-2025-56689 is a medium-severity authentication bypass vulnerability in n/a, published on 3 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.)
Weakness: CWE-290
Which versions are affected by CVE-2025-56689?
It affects 1 product.
Products include Quest One Identity.
How do I fix CVE-2025-56689?
No fix has been published for CVE-2025-56689 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-56689 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56689 exists.
Sources
Also known as GHSA-6q6r-cf26-j7gh.