CVE-2025-54982

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
ZscalerAuthentication Server< 6.2r

References

Timeline

Published
Aug 5, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-549835.2A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstancesCVE-2025-549879.8A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious CVE-2025-549888.4Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to CVE-2025-549897.5Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference deniCVE-2025-54999.8A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesizeCVE-2025-549905.3XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights havCVE-2025-549915.5JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the comCVE-2025-549926.9OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found inCVE-2025-549949.3@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is CVE-2025-549956.5Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and interCVE-2025-549967.2OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-549979.1OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In
CVE-2025-54982: Critical severity, CVSS 9.6 | Vulnix