Introduction
Adobe Connect 12.9 and earlier contains a DOM-based cross-site scripting (XSS) vulnerability, tracked as CVE-2025-49553. An attacker who convinces a user to visit a crafted web page can run arbitrary scripts in that user's browser. For organizations running these versions, that means a real risk of session hijacking and data compromise. The CVSS score is 9.3, with significant impact on confidentiality and integrity.
About Adobe and Adobe Connect: Adobe makes creative, document, and collaboration software with millions of users worldwide. Adobe Connect is its web conferencing platform, used widely by enterprises, educational institutions, and government agencies for virtual meetings, webinars, and online training. Because the platform carries sensitive communications, its security is critical.
Technical information
CVE-2025-49553 is a DOM-based cross-site scripting vulnerability in Adobe Connect versions 12.9 and earlier. The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). Client-side JavaScript in the Adobe Connect application reads data from DOM sources such as document.URL or document.location and inserts it into the DOM without sufficient sanitization.
An attacker can craft a malicious URL or web page that, when a victim visits it, runs arbitrary JavaScript in the context of the Adobe Connect application. The attack requires user interaction, typically a click on a malicious link or a visit to a crafted page. Successful exploitation can lead to session hijacking, which lets the attacker impersonate the user and access sensitive meeting data. The vulnerability is entirely client-side and does not require authentication.
No public code snippets or proof-of-concept exploit are available for this issue.
Affected systems and versions
- Adobe Connect versions 12.9 and earlier are affected.
- All deployment models (hosted, managed service, on-premises) running these versions are vulnerable.
- The vulnerability is in the web client component.
Vendor security history
Adobe Connect has a documented history of XSS and related vulnerabilities, and Adobe issues regular security advisories and patches for it. Earlier bulletins such as APSB25-36 addressed reflected XSS and privilege escalation issues. Adobe runs a public bug bounty program and typically releases patches within industry-standard timeframes. The product receives ongoing security updates and is considered actively maintained.
