CVE-2025-54882
HIGH EPSS 9.5%
Published Aug 7, 202511mo ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
Published Aug 7, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
9.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-522
Affected Products 2
| Vendor | Product | Version | Range |
|---|---|---|---|
| himmelblau-idm | himmelblau | * | ≥0.8.0 – <0.9.22 |
| himmelblau-idm | himmelblau | * | ≥1.0.0 – <1.2.0 |
References 5
- github.com https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad
- github.com https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a
- github.com https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22
- github.com https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0
- github.com https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
Remediation
- github.com https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad
- github.com https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a