CVE-2025-0126: GlobalProtect SAML Auth Bypass Vulnerability

CVE-2025-0126 Overview

CVE-2025-0126 is a session fixation vulnerability in Palo Alto Networks GlobalProtect™ when configured with Security Assertion Markup Language (SAML) authentication. An attacker can impersonate a legitimate authorized user and perform actions as that GlobalProtect user. Exploitation requires the legitimate user to click a malicious link crafted by the attacker.

The SAML login for the PAN-OS® management interface is not affected. The issue does not affect Cloud NGFW, and all Prisma® Access instances are proactively patched. The vulnerability is tracked under [CWE-384: Session Fixation].

Critical Impact
Successful exploitation allows an attacker to hijack an authenticated GlobalProtect VPN session and act as the impersonated user against internal resources.

Affected Products

Palo Alto Networks GlobalProtect™ (SAML-configured deployments)
PAN-OS GlobalProtect portal and gateway components
Prisma Access (proactively patched by vendor)

Discovery Timeline

2025-04-11 - CVE-2025-0126 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-0126

Vulnerability Analysis

The vulnerability resides in the SAML authentication flow used by the GlobalProtect login process. GlobalProtect fails to invalidate or rotate the pre-authentication session identifier after a successful SAML assertion. An attacker who supplies a pre-set session token can therefore inherit the authenticated state once the victim completes login.

The attack relies on user interaction. A victim must click an attacker-controlled link that fixes the session identifier before SAML authentication completes. After the victim authenticates against the identity provider, the attacker reuses the now-authenticated session to access GlobalProtect resources as the victim.

The PAN-OS management interface uses a distinct SAML implementation and remains unaffected. Cloud NGFW deployments do not expose the vulnerable code path.

Root Cause

The root cause is the absence of session identifier rotation between the unauthenticated and authenticated states of the SAML login workflow. CWE-384 describes this class of flaw: authenticating a user without invalidating any existing session token allows an attacker to predetermine the session ID and reuse it after the victim authenticates.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts or distributes a malicious link that initiates a GlobalProtect SAML login flow with an attacker-known session token. The victim must click the link and complete authentication through their organization's identity provider. Once authentication succeeds, the attacker replays the fixed session identifier to act as the victim against the GlobalProtect portal or gateway.

The vulnerability does not allow direct credential theft. The attacker never sees the victim's password or SAML assertion. The compromise is limited to session-level impersonation against GlobalProtect resources.

No public proof-of-concept exploit code is available. For technical details, refer to the Palo Alto Networks CVE-2025-0126 advisory.

Detection Methods for CVE-2025-0126

Indicators of Compromise

GlobalProtect portal access logs showing the same session identifier originating from two distinct client IP addresses or geolocations within a short window.
SAML authentication events for a user immediately followed by GlobalProtect activity from an unexpected source address or device fingerprint.
Inbound clicks on suspicious URLs containing GlobalProtect portal paths with pre-set session or cookie parameters.

Detection Strategies

Correlate identity provider SAML issuance logs with GlobalProtect gateway connection logs to identify session reuse across mismatched client identifiers.
Hunt for GlobalProtect sessions where the post-authentication client IP differs from the IP that initiated the SAML request.
Inspect web proxy and email gateway telemetry for outbound user clicks to crafted GlobalProtect portal URLs hosted on attacker infrastructure.

Monitoring Recommendations

Enable verbose GlobalProtect authentication logging and forward events to a centralized SIEM for correlation with identity provider logs.
Alert on concurrent GlobalProtect sessions for the same user originating from disparate ASNs or countries.
Monitor for phishing campaigns referencing the organization's GlobalProtect portal URL.

How to Mitigate CVE-2025-0126

Immediate Actions Required

Apply the fixed PAN-OS and GlobalProtect versions identified in the Palo Alto Networks CVE-2025-0126 advisory.
Confirm that Prisma Access tenants have received the vendor's proactive patch.
Invalidate active GlobalProtect sessions after patching to clear any pre-fixed session identifiers.

Patch Information

Palo Alto Networks has released fixed software versions for affected GlobalProtect deployments. Refer to the vendor advisory for version-specific guidance and upgrade paths. Cloud NGFW is unaffected, and Prisma Access has been patched by the vendor.

Workarounds

Where patching is delayed, restrict the GlobalProtect portal to known client IP ranges to limit attacker reach.
Enforce multi-factor authentication at the identity provider to raise the bar for session-fixation phishing campaigns.
Train users to access the GlobalProtect portal via bookmarks rather than emailed or messaged links.
Shorten GlobalProtect session lifetimes and require periodic reauthentication to reduce the window of session reuse.

bash

# Example: enforce shorter GlobalProtect session timeout via PAN-OS CLI
configure
set global-protect global-protect-portal <portal-name> client-config configs <config-name> hip-collection max-wait-time 10
set network global-protect global-protect-gateway <gateway-name> client-settings configs <config-name> client-config cookie-lifetime hours 4
commit