Securden Unified PAM Flaw Allows Attackers to Bypass Authentication

Securden Unified PAM is facing four critical vulnerabilities disclosed during red teaming with Rapid7’s Vector Command service, exposing the platform to authentication bypass, unrestricted file uploads, path traversal, and shared infrastructure risks. According to Rapid7, the most severe flaw, CVE-2025-53118 (CVSS 9.4), allows unauthenticated attackers to bypass authentication by manipulating session cookies and CSRF tokens via endpoints such as /thirdparty-access and /get_csrf_token.

The suite also includes unauthenticated unrestricted file uploads (CVE-2025-53119, CVSS 7.5) and a path traversal issue (CVE-2025-53120, CVSS 9.4) in the /accountapp/upload_web_recordings_from_api_server endpoint, potentially enabling remote code execution when combined with authentication bypass. A fourth vulnerability, CVE-2025-6737 (CVSS 7.2), relates to Securden’s Remote Vendor Gateway and shared multi-tenant infrastructure, raising cross-tenant risk.

Affected versions run from 9.0.x through 11.3.1, with patches available in 11.4.4 after swift coordination between Rapid7 and Securden, and Rapid7’s disclosure emphasises the importance of updating to mitigate ransomware, data breach, or supply chain attack risks.