CVE-2025-54603: Claroty Secure Access Auth Bypass Flaw

CVE-2025-54603 Overview

CVE-2025-54603 is an authentication flaw in Claroty Secure Access versions 3.3.0 through 4.0.2. The vulnerability stems from an incorrect OpenID Connect (OIDC) authentication flow implementation. Attackers can exploit this flaw to create unauthorized user accounts or impersonate existing OIDC users. The issue is categorized under [CWE-284] Improper Access Control. Claroty Secure Access is a remote access solution widely deployed in operational technology (OT) and industrial control system (ICS) environments, making this weakness relevant to critical infrastructure operators. The vulnerability is network-exploitable and requires no user interaction or prior authentication. The EPSS probability for exploitation is 0.621% at the 45.87 percentile.

Critical Impact
Attackers can create unauthorized users or impersonate legitimate OIDC users in Claroty Secure Access deployments, gaining access to remote sessions into sensitive OT environments.

Affected Products

Claroty Secure Access 3.3.0
Claroty Secure Access versions between 3.3.0 and 4.0.2
Claroty Secure Access 4.0.2

Discovery Timeline

2025-10-14 - CVE-2025-54603 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54603

Vulnerability Analysis

The vulnerability resides in how Claroty Secure Access processes the OpenID Connect authentication flow. OIDC extends OAuth 2.0 to provide identity verification through ID tokens issued by trusted identity providers. When an OIDC flow is implemented incorrectly, the relying party can fail to properly bind an authenticated identity to the correct internal user account. In this case, the flawed logic allows the platform to either provision a new user account tied to attacker-controlled identity claims or associate an inbound authentication with an existing OIDC user record. This translates directly into account takeover or unsanctioned account creation without exploiting a memory corruption or code execution bug.

Root Cause

The root cause is improper access control [CWE-284] in the OIDC handler. The application does not correctly validate or bind identity claims returned by the identity provider before mapping them to internal accounts. Refer to the Claroty Product Security Guide for vendor-provided configuration guidance.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the Secure Access authentication endpoint and interact with the OIDC flow can submit crafted identity claims. The server processes these claims and either creates a new privileged account or authenticates the session as an existing OIDC user. No verified public proof-of-concept is available at the time of writing.

Exploitation code is not published. The vulnerability mechanism can be summarized as: an OIDC callback accepting identity assertions without correctly validating the subject-to-account binding, allowing an attacker-supplied identity to resolve to an existing account or trigger implicit user provisioning.

Detection Methods for CVE-2025-54603

Indicators of Compromise

Unexpected user accounts appearing in Claroty Secure Access, particularly accounts provisioned through OIDC without a corresponding request from IT.
Authentication events for existing OIDC users originating from unusual source IP addresses, geolocations, or user agents.
OIDC callback requests to Secure Access endpoints that do not correlate with a matching authorization request initiated by a known user.
Session establishment from OIDC-authenticated accounts outside of normal working hours or against unusual OT assets.

Detection Strategies

Correlate identity provider logs with Claroty Secure Access authentication logs to identify OIDC sign-ins that lack a matching upstream authorization event.
Alert on any new user creation in Secure Access that was not initiated by an administrator or an approved automated provisioning workflow.
Baseline OIDC login patterns per user and flag deviations in source network, device fingerprint, or session behavior.

Monitoring Recommendations

Forward Secure Access authentication and audit logs to a central SIEM or data lake for retention and correlation with identity provider telemetry.
Monitor administrative actions and remote session initiation performed by any account authenticated through OIDC during the exposure window.
Track configuration changes to the OIDC connector, redirect URIs, and client secrets on the Secure Access appliance.

How to Mitigate CVE-2025-54603

Immediate Actions Required

Upgrade Claroty Secure Access to a fixed version above 4.0.2 as specified in the vendor advisory.
Audit all user accounts in Secure Access and remove any accounts that were not explicitly authorized.
Rotate OIDC client secrets and force reauthentication for all OIDC-linked accounts after patching.
Restrict network access to the Secure Access authentication endpoints to trusted management networks where feasible.

Patch Information

Claroty has published guidance for the affected OIDC configuration. Refer to the Claroty Product Security Guide and the Claroty home page for current advisories and fixed versions. Apply the vendor-recommended update to any deployment running versions 3.3.0 through 4.0.2.

Workarounds

Temporarily disable the OIDC authentication method and require local or SAML-based authentication until the patch is deployed.
Enforce strict allow-listing on the OIDC identity provider so only expected users can complete authentication to Secure Access.
Enable multi-factor authentication at the identity provider and require step-up authentication for privileged Secure Access roles.

bash

# Configuration example: restrict access to the Secure Access authentication endpoint
# Replace the CIDR with your management network range
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP