CVE-2025-56689
MEDIUM EPSS 66.1%
Published Sep 3, 20259mo ago · Modified Jun 17, 20261w ago
4.6 CVSS 3.1
Published Sep 3, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago
Description
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.)
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
66.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-290
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| quest | one_identity | 7.5.1.20903 | any |
References 1
- medium.com https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.