dbcve.org
Information ExposureWeakness · CWE-200

CVE-2025-34064

CRITICAL · 9.0 CVSS v4.0 Published 2025-07-01
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
99/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

OneLogin AD Connector sends tenant log data to a hardcoded, unvalidated S3 bucket (onelogin-adc-logs-production). Attackers can register this bucket and intercept logs containing directory tokens, user metadata, and environment configuration, enabling JWT signing key recovery and cross-tenant data leakage.

MitigationOneLogin must patch the AD Connector to validate S3 bucket ownership before sending logs, or migrate to tenant-specific secured buckets. Customers should monitor for unexpected log destinations and review their tenant for signs of compromise.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify OneLogin AD Connector installation
    Check system for OneLogin AD Connector software - look for installed packages, services, or processes named 'onelogin-ad-connector' or 'AD Connector'. On Windows check Program Files, on Linux check /opt or /usr/local for onelogin directories.
    Affected if OneLogin AD Connector is installed and running in the environment
  2. Examine S3 logging configuration
    Locate the configuration file for OneLogin AD Connector (typically in the installation directory or /etc/onelogin). Look for S3-related settings, particularly any 'bucket', 'log', or 's3' configuration entries.
    Affected if Configuration points to S3 bucket 'onelogin-adc-logs-production' or a non-tenant-specific bucket
  3. Verify bucket ownership validation
    Check if AWS S3 Block Public Access is enabled at account level, or examine bucket policy for ownership validation statements (s3:OwnershipControls). Also check if bucket is configured to reject uploads without valid ownership.
    Affected if No bucket ownership validation is configured and logs are being sent to shared/production bucket
  4. Inspect network traffic to S3
    Use network monitoring (tcpdump, Wireshark, or cloudtrail logging) to observe outbound connections from the AD Connector server to AWS S3 endpoints. Identify if connections target onelogin-adc-logs-production bucket.
    Affected if Active connections are being made to onelogin-adc-logs-production or unknown S3 buckets
  5. Review log destination configuration
    In OneLogin AD Connector admin interface or config files, check the 'Log' or 'Export' settings. Determine if tenant-specific bucket or customer-managed bucket is configured versus default production bucket.
    Affected if Using default/legacy bucket configuration without tenant isolation

Environment is affected if OneLogin AD Connector is installed and configured to send logs to the hardcoded onelogin-adc-logs-production bucket without bucket ownership validation controls in place.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

OneLogin must patch the AD Connector to validate S3 bucket ownership before sending logs, or migrate to tenant-specific secured buckets. Customers should monitor for unexpected log destinations and review their tenant for signs of compromise.

Recommended fix Moderate confidence
  1. 1. Identify all OneLogin AD Connector deployments using the affected configuration
  2. 2. Review the S3 bucket configuration for onelogin-adc-logs-production in your environment
  3. 3. Verify that your S3 bucket policies restrict access appropriately and are not publicly accessible
  4. 4. Contact OneLogin support (support.onelogin.com) to obtain the official remediation guidance for this misconfiguration
  5. 5. Implement any bucket ownership validation or tenant-specific bucket configuration as directed by OneLogin
  6. 6. Audit logs that may have been sent to the unclaimed bucket for any unauthorized access
  7. 7. Rotate any credentials or tokens that may have been exposed in logs (directory tokens, API keys, etc.)
  8. 8. Monitor for signs of compromise including unexpected JWT token usage or user impersonation attempts

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,930
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-34064 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-34064 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data