Introduction
An attacker with even a low-privileged JumpServer account can use a critical flaw to impersonate administrators and reach sensitive assets. The vulnerability, tracked as CVE-2025-62712, affects JumpServer versions prior to v3.10.20-lts and v4.10.11-lts. It allows unauthorized retrieval of the connection tokens of any user in the system.
About JumpServer: JumpServer is an open source Privileged Access Management (PAM) platform developed by Fit2Cloud. It is widely used in China and internationally to secure and audit access to infrastructure assets. JumpServer manages SSH, RDP, database, and cloud connections for thousands of organizations, so a flaw in its access control has a large impact.
Technical Information
CVE-2025-62712 is a critical authorization vulnerability classified under CWE-862 (Missing Authorization). The flaw is in the /api/v1/authentication/super-connection-token/ API endpoint. In affected versions, this endpoint does not limit the returned connection tokens to those the requesting user owns or is authorized for. It returns every connection token in the database, whoever owns it.
Vulnerability mechanism:
- Any authenticated user, including a non-privileged account, can send an HTTP GET request to the vulnerable endpoint.
- The response includes connection tokens for all users, including highly privileged accounts such as administrators.
- An attacker can use these tokens to start sessions on managed assets as the original token owners, which gives them privilege escalation and unauthorized access.
Root cause:
- The API endpoint does not check authorization or filter results by the requesting user's identity.
- There is no evidence of row-level security or permission validation in the endpoint's logic, so any caller can enumerate every token.
Exploitation details:
- Exploitation requires only valid credentials for any user account.
- An attacker can reach the endpoint and retrieve tokens with a standard HTTP client or browser tools.
- No advanced technical skills or exploit code are required.
No public code snippets or vulnerable code samples are available for this issue. All technical details come from vendor advisories and public documentation.
Affected Systems and Versions
- JumpServer versions prior to v3.10.20-lts are affected (legacy long-term support branch)
- JumpServer versions prior to v4.10.11-lts are affected (current generation branch)
- Both Community and Enterprise Editions are affected, because the vulnerability is in core authentication logic
- The vulnerability is present regardless of deployment configuration
Vendor Security History
JumpServer has had several authorization and authentication vulnerabilities in recent years, including:
- CVE-2023-43652: the core API did not verify that requests came from authorized components, which allowed token generation and session impersonation
- CVE-2025-27095: low-privileged users could leak Kubernetes tokens by manipulating the kubeconfig file
- CVE-2023-42819: a directory traversal vulnerability that allowed arbitrary file access
Patch response times have ranged from weeks to months, though recent vulnerabilities have been fixed more quickly. JumpServer publishes security advisories on GitHub and through its official documentation channels.
