CVE-2025-10280 Overview
CVE-2025-10280 is a Cross-Site Scripting (XSS) vulnerability in SailPoint IdentityIQ [CWE-79]. The flaw affects IdentityIQ 8.5, 8.4 through 8.4p3, 8.3 through 8.3p5, and all prior versions. Certain IdentityIQ web services that return non-HTML content can be accessed through a URL path that forces the response Content-Type header to HTML. A browser then interprets the returned data as HTML, executing any unescaped script content in the context of the IdentityIQ application.
Critical Impact
Attackers can craft URLs that coerce IdentityIQ web services into serving content as HTML, enabling script execution in an authenticated user's browser session.
Affected Products
- SailPoint IdentityIQ 8.5
- SailPoint IdentityIQ 8.4 and all patch levels prior to 8.4p4
- SailPoint IdentityIQ 8.3 and all patch levels including 8.3p5, plus all prior versions
Discovery Timeline
- 2025-11-03 - CVE-2025-10280 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10280
Vulnerability Analysis
The vulnerability stems from inconsistent handling of the HTTP Content-Type response header across IdentityIQ web service endpoints. IdentityIQ exposes several web services that return non-HTML payloads such as JSON or plain text. When these endpoints are accessed through specific URL paths, the server assigns a text/html Content-Type instead of the payload's actual type. Because the underlying content was never escaped for HTML rendering, any attacker-controlled data embedded in the response executes as script in the requesting browser.
Exploitation requires user interaction, typically clicking a crafted link. The scope is changed because script runs in the trusted origin of the IdentityIQ application, allowing session token access, request forgery against the identity governance platform, and impersonation of privileged administrators managing access reviews or provisioning workflows.
Root Cause
The root cause is an incorrect Content-Type assignment on web service responses combined with missing output encoding [CWE-79]. IdentityIQ trusts the URL path to determine the response Content-Type rather than the underlying service handler's payload format. Data intended for machine consumption bypasses HTML escaping, so any <script> or event-handler payload survives to the browser parser.
Attack Vector
An unauthenticated attacker crafts a URL targeting a vulnerable IdentityIQ web service path that mislabels its content as HTML. The URL is delivered through phishing, embedded in a third-party page, or posted to a channel accessible to IdentityIQ users. When a signed-in IdentityIQ user follows the link, the malicious script executes with the user's session context, exposing identity governance data and administrative capabilities.
No verified public exploit code is available for CVE-2025-10280. Refer to the SailPoint Security Advisory CVE-2025-10280 for authoritative technical details.
Detection Methods for CVE-2025-10280
Indicators of Compromise
- Web server or reverse-proxy logs showing requests to IdentityIQ web service paths returning Content-Type: text/html when a JSON or text response was expected.
- Referrer headers pointing to external or untrusted domains prior to IdentityIQ authenticated sessions.
- Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after visits to IdentityIQ URLs.
Detection Strategies
- Inspect access logs for IdentityIQ web service endpoints containing script-like query parameters such as <, >, onerror=, or URL-encoded equivalents.
- Enable Content Security Policy (CSP) reporting to capture inline-script and event-handler violations originating from IdentityIQ responses.
- Correlate authenticated IdentityIQ session activity with anomalous DOM events or newly issued API tokens using web application firewall (WAF) telemetry.
Monitoring Recommendations
- Alert on IdentityIQ responses whose Content-Type differs from the expected content signature for the requested service path.
- Monitor administrative IdentityIQ accounts for session actions originating shortly after clicks on externally referred URLs.
- Track the SailPoint advisory page for updates to affected versions and patch guidance.
How to Mitigate CVE-2025-10280
Immediate Actions Required
- Upgrade IdentityIQ 8.4 deployments to patch level 8.4p4 or later.
- Plan migration off IdentityIQ 8.3 and earlier branches, as fixes require moving to a supported patched release.
- For IdentityIQ 8.5, apply the vendor-published fix referenced in the SailPoint advisory once available in your environment.
- Review recent authenticated IdentityIQ session activity for signs of exploitation before patching.
Patch Information
SailPoint published remediation guidance in the SailPoint Security Advisory CVE-2025-10280. IdentityIQ 8.4 users should install 8.4p4. Administrators of 8.3 and earlier versions must upgrade to a supported patched release because 8.3p5 remains affected.
Workarounds
- Deploy a WAF rule that rewrites or blocks IdentityIQ responses whose Content-Type does not match the expected MIME type for the requested service path.
- Enforce a strict Content Security Policy on the IdentityIQ application to restrict inline script execution and untrusted event handlers.
- Restrict IdentityIQ web access to trusted networks or VPN users, reducing exposure to phishing-delivered exploit URLs until patches are applied.
# Example WAF rule concept: block IdentityIQ web service responses
# that claim text/html Content-Type on known JSON endpoints
SecRule REQUEST_URI "@rx ^/identityiq/(rest|ws)/" \
"id:1010280,phase:4,deny,status:502,\
chain,msg:'CVE-2025-10280 Content-Type mismatch'"
SecRule RESPONSE_HEADERS:Content-Type "@contains text/html"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
