Claroty Patches Authentication Bypass Flaw

Claroty has patched CVE-2025-54603, a authentication bypass flaw in its on‑premises OpenID Connect (OIDC) feature of Claroty Secure Remote Access (SRA) that could let attackers create unauthorized users, impersonate existing OIDC users, and gain full admin control. The vulnerability stems from an incorrect OIDC authentication flow when OIDC is configured, a flaw described by the National Institute of Standards and Technology as enabling unauthorized user creation or impersonation.

Researchers at Limes Security discovered and reported the issue earlier this year during a routine pen test for a customer, revealing that the bug could bypass authentication and grant admin and user access, even if multifactor authentication is enabled. Such flaws highlight why simply disabling OIDC is not sufficient, since the vulnerability remains exploitable until a fix is deployed, according to Benjamin Oberdorfer of Limes Security.

The broader context shows strong and growing demand for remote access tools to OT/ICS, with 55% of organisations in a Claroty survey using four or more tools and 33% using six or more, exacerbating risk in critical environments.