CVE-2025-52925: OneLogin AD Connector Information Disclosure

CVE-2025-52925 Overview

CVE-2025-52925 is a cryptographic weakness in the One Identity OneLogin Active Directory Connector before version 6.1.5. The vulnerability, tracked internally as ST-812, stems from mishandled encryption of the DirectoryToken. The DirectoryToken is the credential used by the connector to authenticate against the OneLogin service on behalf of an Active Directory (AD) integration. An attacker with low-privileged access to a system where the token is stored or transmitted could recover the token due to weak or improper protection of sensitive information at rest ([CWE-402]).

Critical Impact
Recovery of the DirectoryToken could allow an attacker to impersonate the AD Connector against the OneLogin tenant, exposing identity and directory synchronization data.

Affected Products

One Identity OneLogin Active Directory Connector versions prior to 6.1.5
Environments synchronizing on-premises Active Directory with OneLogin
Deployments where the DirectoryToken is persisted on Windows hosts running the connector

Discovery Timeline

2025-07-02 - CVE-2025-52925 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-52925

Vulnerability Analysis

The OneLogin Active Directory Connector bridges on-premises AD with the OneLogin identity-as-a-service platform. Authentication between the connector and OneLogin relies on a shared secret referred to as the DirectoryToken. In versions before 6.1.5, the connector mishandled encryption of this token. The exact defect is not enumerated in the public advisory, but the CWE-402 (Transmission of Private Resources into a New Sphere) mapping indicates that sensitive material crossed a trust boundary without adequate protection.

An authenticated actor with local or adjacent access to the connector host can retrieve the token. Because the scope changes according to the CVSS vector, exposure extends beyond the local host to the OneLogin tenant that trusts the token. The confidentiality impact is limited to the token and information reachable with it; integrity and availability of the connector itself are not directly affected.

Root Cause

The root cause is improper cryptographic protection of the DirectoryToken during storage or transmission. Under [CWE-402], secrets are moved into a sphere where the original protection assumptions no longer hold. This class of flaw typically involves plaintext persistence, use of a static or reversible key, or reliance on file-system permissions instead of cryptographic controls.

Attack Vector

An attacker with authenticated access to the host running the vulnerable connector reads the DirectoryToken from its stored location. The attacker then reuses the token to interact with OneLogin APIs as the connector identity. Because the credential authorizes directory synchronization operations, the attacker can enumerate directory attributes or manipulate synchronization data pushed to OneLogin. No user interaction is required, and attack complexity is low.

No public proof-of-concept has been released. The vulnerability mechanism is described in the OneLogin Support Article published by One Identity.

Detection Methods for CVE-2025-52925

Indicators of Compromise

Unexpected read access to OneLogin AD Connector configuration files or registry keys containing the DirectoryToken
OneLogin API calls originating from IP addresses that do not match the registered connector host
Directory synchronization events occurring outside the connector's normal schedule
Non-service-account processes accessing the connector's installation directory

Detection Strategies

Inventory all Windows hosts running the OneLogin Active Directory Connector and confirm the installed version against 6.1.5
Correlate OneLogin admin audit logs with expected connector source IPs and time windows
Alert on file or registry read events targeting the connector's credential store by processes other than the connector service
Baseline outbound HTTPS traffic from connector hosts to *.onelogin.com and flag deviations

Monitoring Recommendations

Forward OneLogin event logs and Windows Security event logs into a centralized SIEM for cross-source correlation
Monitor for privilege escalation and credential access techniques on connector hosts, mapped to MITRE ATT&CK T1552 (Unsecured Credentials)
Track service account and API token usage in OneLogin for anomalous geolocation, user-agent, or volume patterns

How to Mitigate CVE-2025-52925

Immediate Actions Required

Upgrade the OneLogin Active Directory Connector to version 6.1.5 or later on every host running the agent
Rotate the DirectoryToken for each affected connector after upgrading
Restrict interactive and remote access to connector hosts to a minimal set of administrators
Review OneLogin admin audit logs for anomalous directory operations preceding the upgrade

Patch Information

One Identity addressed the issue in OneLogin Active Directory Connector 6.1.5. Refer to the vendor advisory at the OneLogin Support Article for download instructions and release notes. No official workaround exists that fully substitutes for applying the patch.

Workarounds

Apply strict NTFS access control lists to the connector installation directory to limit which local accounts can read stored credentials
Run the connector under a dedicated service account with the minimum privileges required for directory synchronization
Isolate connector hosts on a management VLAN and block inbound access from user workstations
Enforce multi-factor authentication and conditional access on OneLogin administrator accounts to contain token misuse

bash

# Verify installed OneLogin AD Connector version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*OneLogin*Active Directory*Connector*" } |
  Select-Object DisplayName, DisplayVersion, Publisher