CVE-2025-53003CWE-200CWE-269CWE-284

Janssen Config API returns results without scope verification

High · published July 1, 2025

CVSS v4.0
8.2
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00410 · 34.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-269 · Improper Privilege Management; CWE-284 · Improper Access Control
Published
2025-07-01T01:22Z
EPSS history
Timeline
  • 01 JUL 01:22Z
    Janssen Config API returns results without scope verification
    cvelistv5