Introduction
An attacker who can read an OIDC client secret through a public API can impersonate the enterprise application it belongs to and compromise its authentication flows. CVE-2025-59363 affects organizations running One Identity OneLogin before version 2025.3.0, where the GET Apps API v2 endpoint returned these credentials. That is a serious risk for any environment that relies on federated identity.
One Identity is a large identity and access management vendor, and OneLogin is its cloud-based SSO and identity federation platform. Thousands of organizations worldwide use OneLogin to centralize authentication and authorization, so a vulnerability in its core authentication flows has a wide reach.
Technical Information
The flaw sits in the GET Apps API v2 endpoint in OneLogin versions before 2025.3.0. The endpoint exists to retrieve application configuration, and its response included the OIDC client secret field, even for routine queries made after the app was created. OIDC best practices and security standards say the client secret should be provided only when the application is registered, and never again in a later API response.
The flaw is classified as CWE-669 (Incorrect Resource Transfer Between Spheres). Here, the OIDC client secret moved from a secure context, where access to it should be tightly controlled, to the broader set of API consumers. That breaks the principles of least privilege and information boundaries. Any user or system with access to the GET Apps API v2 could enumerate applications and retrieve their client secrets. With a secret, an attacker could:
- Impersonate the application by using the secret to authenticate as it
- Manipulate authentication flows, potentially issuing tokens or accessing user data
- Move laterally across federated applications if secrets are reused or permissions are broad
No public code snippets or exploit scripts are available. The vendor's documentation and release notes confirm the mechanism.
Affected Systems and Versions
- Product: One Identity OneLogin
- Affected versions: All versions before 2025.3.0
- Vulnerable configuration: Any deployment where the GET Apps API v2 endpoint is accessible and OIDC applications are configured
Vendor Security History
One Identity has had several notable vulnerabilities in 2025, including critical issues in its Active Directory Connector (CVE-2025-52925). The vendor patched these flaws promptly, but high-impact vulnerabilities keep turning up in its authentication flows, which points to ongoing problems with secure development and testing. Organizations should monitor One Identity advisories and patch core authentication infrastructure quickly.
