CVE-2025-53003highCWE-200CWE-269CWE-284

CVE-2025-53003: falha de alta gravidade em JanssenProject jans

Janssen Config API returns results without scope verification

Publicada em

Seguir esta CVE+ Monitorar jans+ Monitorar io.jans:jans-config-api-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.4%
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
JanssenProject · jans
CVEs relacionadas — JanssenProject jans

No mesmo produto, das mais perigosas para as menos.

CVE-2025-54876MEDIUMJans CLI stores plaintext passwords in the local cli_cmd.log fileEPSS 0.5%CVE-2026-45795MEDIUMJanssen Project: JWE Request Object Signature Verification Bypass in jans-auth-serverEPSS 0.2%