CVE-2025-59363

Description

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),

PUBLISHED Reserved 2025-09-14 | Published 2025-09-14 | Updated 2025-09-15 | Assigner mitre

Problem types

CWE-669 Incorrect Resource Transfer Between Spheres

Product status

References

onelogin.service-now.com/...a0d76d70db185340d5505eea4b96199f

cve.org (CVE-2025-59363)

nvd.nist.gov (CVE-2025-59363)

Download JSON