CVE-2025-63291: Alteryx Server Auth Bypass Vulnerability

CVE-2025-63291 Overview

CVE-2025-63291 is an Insecure Direct Object Reference (IDOR) vulnerability in Alteryx Server versions 2022.1.1.42654 and 2024.1. The server exposes API endpoints that accept MongoDB object IDs to identify requested records. The application fails to verify whether the authenticated caller is authorized to access the referenced object. Any authenticated user can enumerate or guess object IDs to retrieve records belonging to other users. Exposed records include administrative API keys and private studio API keys, which attackers can reuse to escalate access across the Alteryx deployment.

Critical Impact
Authenticated attackers can retrieve administrative and private studio API keys belonging to other users, enabling account takeover and privileged API abuse.

Affected Products

Alteryx Server 2022.1.1.42654
Alteryx Server 2024.1
Alteryx Server API v3 endpoints that resolve MongoDB object IDs

Discovery Timeline

2025-11-14 - CVE-2025-63291 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63291

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference flaw mapped to [CWE-639] (Authorization Bypass Through User-Controlled Key) and [CWE-648] (Incorrect Use of Privileged APIs). Alteryx Server exposes REST endpoints that accept a MongoDB ObjectId as a lookup key for records such as users, workflows, collections, and API credentials. The server authenticates the caller but does not enforce an authorization check tying the requested object to the caller's identity or role. An attacker with any valid session can swap the object ID in the request path or query string and receive the corresponding record. Retrieved records include administrative API keys and private studio API keys, which can then be used to call privileged Alteryx Server APIs as another principal.

Root Cause

The root cause is a missing object-level authorization check in the request handler. The code trusts the client-supplied ObjectId and returns the matching document without comparing the record's owner, tenant, or permission scope against the authenticated session. MongoDB object IDs embed a timestamp and counter, which further reduces the entropy an attacker must overcome when enumerating valid IDs.

Attack Vector

Exploitation requires network access to the Alteryx Server API and valid low-privileged credentials. An attacker authenticates to the API, obtains a legitimate object ID from a normal response, then modifies the ID in subsequent requests to target records owned by other users or administrators. By iterating through candidate object IDs, the attacker harvests administrative and studio API keys. Those harvested keys are then reused against the same API to perform privileged actions, read sensitive workflow data, or move laterally within the Alteryx environment.

No verified public exploit code is available at the time of writing. See the Medium Advisory on Alteryx Server IDOR and the Alteryx Server API Overview for endpoint context.

Detection Methods for CVE-2025-63291

Indicators of Compromise

Repeated API v3 requests from a single session that iterate across many distinct MongoDB object IDs within a short time window.
Successful 200 responses to object ID lookups that do not match the caller's prior browsing or workflow activity.
Unexpected use of administrative or studio API keys from source IP addresses or user agents not associated with their legitimate owners.
Spikes in GET requests against user, collection, or credential endpoints referencing 24-character hexadecimal identifiers.

Detection Strategies

Baseline normal object ID access patterns per user and alert on sessions that request records owned by other principals.
Correlate Alteryx Server application logs with reverse-proxy or load-balancer access logs to identify sequential ID enumeration.
Detect use of API keys from a different IP, ASN, or geolocation than their historical origin.

Monitoring Recommendations

Forward Alteryx Server IIS and application logs to a centralized logging platform and retain at least 90 days of request history.
Monitor administrative API key usage and alert on first-seen client IPs or user agents.
Review audit logs for unexpected key rotations, user role changes, or workflow exports following suspicious API activity.

How to Mitigate CVE-2025-63291

Immediate Actions Required

Upgrade Alteryx Server to a vendor-fixed release that enforces object-level authorization checks on API v3 endpoints.
Rotate all administrative API keys and private studio API keys, assuming the previous keys may have been exposed.
Restrict Alteryx Server API access to trusted networks using firewall or reverse-proxy allow lists.
Audit recent API activity for enumeration of MongoDB object IDs and investigate any confirmed cross-user access.

Patch Information

Alteryx has not published a dedicated vendor advisory in the enriched reference set. Administrators should consult the Alteryx Server API V3 Configuration documentation and contact Alteryx support to confirm the fixed build that addresses CVE-2025-63291 for versions 2022.1.1.42654 and 2024.1.

Workarounds

Disable or tightly scope the Alteryx Server API v3 if it is not required for business workflows.
Issue short-lived API keys and enforce frequent rotation to limit the useful lifetime of any key an attacker may harvest.
Place the Alteryx Server behind an authenticating reverse proxy that enforces per-user authorization on sensitive endpoints.
Apply least-privilege roles so that compromised studio accounts cannot reach administrative objects.

bash

# Example: restrict Alteryx Server API access at the reverse proxy (nginx)
location /webapi/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass https://alteryx-server.internal;
}