CVE-2025-59363

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-669

Affected software

Vendor	Product	Versions
One Identity	OneLogin	< 2025.3.0

References

https://onelogin.service-now.com/support?id=kb_article&sys_id=b0aad1e11bd3ea109a47ec29b04bcb72&kb_category=a0d76d70db185340d5505eea4b96199f

Timeline

Published: Sep 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-593645.3The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/CVE-2025-593656.9A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability CVE-2025-593669.2An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba func CVE-2025-593679.8An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac CVE-2025-593686.0An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a cra CVE-2025-593695.9A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiall CVE-2025-59374.3The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques CVE-2025-593707.5A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potent CVE-2025-593717.5An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili CVE-2025-593738.5A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when a CVE-2025-593749.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro