CVE-2025-34064CWE-200CWE-668

OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

Critical · published July 1, 2025

CVSS v4.0
9.0
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

The record
Technical detail
CVSS v4.0
9.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00529 · 43.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-668 · Exposure of Resource to Wrong Sphere
Published
2025-07-01T14:49Z
EPSS history
Timeline
  • 01 JUL 14:49Z
    OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage
    cvelistv5