Introduction
Unauthorized access to a virtual desktop can expose sensitive business data and disrupt critical workflows. This post summarizes CVE-2025-12779, a newly disclosed high-severity issue in the Amazon WorkSpaces client for Linux. On machines where several users share one client, a local user can extract authentication tokens and access other users' WorkSpaces.
About Amazon WorkSpaces and AWS: Amazon Web Services (AWS) dominates the global cloud computing market and provides infrastructure and platform services to millions of organizations. Amazon WorkSpaces is AWS's Desktop-as-a-Service (DaaS) offering, which gives enterprises worldwide secure remote desktop access. WorkSpaces is widely used in regulated industries, large enterprises, and organizations with distributed workforces.
Technical Information
CVE-2025-12779 affects versions 2023.0 through 2024.8 of the Amazon WorkSpaces client for Linux. The cause is improper handling of the authentication tokens used for DCV-based WorkSpaces sessions. When multiple users share a Linux client machine, the client may inadvertently expose those tokens to other local users. The client does not adequately isolate or protect the token data, so a local user can extract another user's token and use it to access that user's WorkSpace.
The vulnerability is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). Exploitation requires local access to the affected client machine. With an extracted token, an attacker can impersonate the victim and gain access to their WorkSpace, including any applications or data available in that session. WorkSpaces clients that use protocols other than DCV, such as PCoIP, are not affected.
No public code snippets or detailed exploitation scripts are available for this vulnerability.
Patch Information
AWS has released version 2025.0 of the Amazon WorkSpaces client for Linux to fix the token handling. The update manages authentication tokens for DCV-based WorkSpaces securely, so other local users can no longer use them to reach another user's WorkSpace. Users should upgrade to version 2025.0 or later. The updated client is available from the Amazon WorkSpaces Client Download page.
Patch source: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-025/
Affected Systems and Versions
- Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8
- Only DCV-based WorkSpaces sessions are affected
- WorkSpaces clients using PCoIP are not affected
- The vulnerability is present in shared or multi-user Linux client environments
Vendor Security History
Amazon Web Services has a strong record of responding quickly to security issues. Previous vulnerabilities in Amazon WorkSpaces include CVE-2025-0500 and CVE-2025-0501, both related to authentication and session security in WorkSpaces and related services. AWS typically issues security bulletins and patches promptly, and it maintains a formal disclosure process for vulnerabilities in its products.
