OneLogin Identity Lifecycle Management

• CVE-2025-59363 ↗HIGH 7.72025

  In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),

• CVE-2025-52924 ↗MEDIUM 4.02025

  In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.

• CVE-2025-52925 ↗MEDIUM 5.02025

  In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.

• …and 6 more · see all on the vendor page →

No datasheets, whitepapers, case studies, videos, or demos linked yet.

• One Identity Active Roles · One Identity
• One Identity Identity Manager · One Identity
• One Identity Safeguard · One Identity
• OneLogin Advanced Directory · OneLogin
• OneLogin Virtual LDAP Service · OneLogin
• Opal Security Intelligence · Opal Security
• Opal Security Platform · Opal Security
• Opal Security Terraform Provider · Opal Security