OneLogin Bug Let Attackers Use API Keys to Steal OIDC Secrets and Impersonate Apps

A high-severity vulnerability has been disclosed in the One Identity OneLogin Identity and Access Management (IAM) solution, which could expose OpenID Connect application client secrets under certain circumstances. The flaw, tracked as CVE-2025-59363 and rated 7.7 out of 10, involves incorrect resource transfer between spheres, allowing attackers with valid API credentials to enumerate and retrieve client secrets for all OIDC applications within an organisation’s OneLogin tenant, according to Clutch Security.

The issue stems from the /api/2/apps endpoint being configured to return more data than expected, including client_secret values in API responses. Following responsible disclosure on 18 July 2025, OneLogin addressed the vulnerability in version 2025.3.0, which was released last month by removing visibility of OIDC client_secret values; there is no evidence it was exploited in the wild.

The RBAC model in OneLogin grants API keys broad endpoint access, and the lack of IP address allowlisting means the flaw could be exploited from anywhere, the report notes.