CVE-2025-53003
This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-269, CWE-284
- Source
- security-advisories@github.com
References
- https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1
- https://github.com/JanssenProject/jans/issues/11575
- https://github.com/JanssenProject/jans/releases/tag/v1.8.0
- https://github.com/JanssenProject/jans/security/advisories/GHSA-373j-mhpf-84wg
- https://github.com/JanssenProject/jans/issues/11575
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.