CVE-2025-53003
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-53003
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53003.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-53003
- Aliases
- Published
- 2025-07-01T02:15:22Z
- Modified
- 2025-07-03T16:54:42.800413Z
- Summary
- [none]
- Details
-
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.
- References
Affected packages
Git / github.com/janssenproject/jans
Affected ranges
- Type
- GIT
- Repo
- https://github.com/janssenproject/jans
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
1.*
1.0.0-a3
1.0.0-a4
charts-v1.*
charts-v1.0.0-beta.14
docker-jans-auth-server-v1.*
docker-jans-auth-server-v1.0.0-beta.13
docker-jans-auth-server-v1.0.0-beta.14
docker-jans-auth-server-v1.0.0-beta.15
docker-jans-auth-server-v1.0.0-beta.16
docker-jans-certmanager-v1.*
docker-jans-certmanager-v1.0.0-beta.13
docker-jans-certmanager-v1.0.0-beta.14
docker-jans-certmanager-v1.0.0-beta.15
docker-jans-certmanager-v1.0.0-beta.16
docker-jans-client-api-v1.*
docker-jans-client-api-v1.0.0-beta.13
docker-jans-client-api-v1.0.0-beta.14
docker-jans-client-api-v1.0.0-beta.15
docker-jans-client-api-v1.0.0-beta.16
docker-jans-config-api-v1.*
docker-jans-config-api-v1.0.0-beta.13
docker-jans-config-api-v1.0.0-beta.14
docker-jans-config-api-v1.0.0-beta.15
docker-jans-config-api-v1.0.0-beta.16
docker-jans-configurator-v1.*
docker-jans-configurator-v1.0.0-beta.13
docker-jans-configurator-v1.0.0-beta.14
docker-jans-configurator-v1.0.0-beta.15
docker-jans-configurator-v1.0.0-beta.16
docker-jans-fido2-v1.*
docker-jans-fido2-v1.0.0-beta.13
docker-jans-fido2-v1.0.0-beta.14
docker-jans-fido2-v1.0.0-beta.15
docker-jans-fido2-v1.0.0-beta.16
docker-jans-persistence-loader-v1.*
docker-jans-persistence-loader-v1.0.0-beta.13
docker-jans-persistence-loader-v1.0.0-beta.14
docker-jans-persistence-loader-v1.0.0-beta.15
docker-jans-persistence-loader-v1.0.0-beta.16
docker-jans-scim-v1.*
docker-jans-scim-v1.0.0-beta.13
docker-jans-scim-v1.0.0-beta.14
docker-jans-scim-v1.0.0-beta.15
docker-jans-scim-v1.0.0-beta.16
docs-v1.*
docs-v1.0.0-beta.15
docs-v1.0.0-beta.16
jans-auth-server-v1.*
jans-auth-server-v1.0.0-beta.15
jans-auth-server-v1.0.0-beta.16
jans-bom-v1.*
jans-bom-v1.0.0-beta.15
jans-bom-v1.0.0-beta.16
jans-cli-v1.*
jans-cli-v1.0.0-beta.15
jans-cli-v1.0.0-beta.16
jans-client-api-v1.*
jans-client-api-v1.0.0-beta.15
jans-client-api-v1.0.0-beta.16
jans-config-api-v1.*
jans-config-api-v1.0.0-beta.15
jans-config-api-v1.0.0-beta.16
jans-core-v1.*
jans-core-v1.0.0-beta.15
jans-core-v1.0.0-beta.16
jans-eleven-v1.*
jans-eleven-v1.0.0-beta.15
jans-eleven-v1.0.0-beta.16
jans-fido2-v1.*
jans-fido2-v1.0.0-beta.15
jans-fido2-v1.0.0-beta.16
jans-linux-setup-v1.*
jans-linux-setup-v1.0.0-beta.15
jans-linux-setup-v1.0.0-beta.16
jans-notify-v1.*
jans-notify-v1.0.0-beta.15
jans-notify-v1.0.0-beta.16
jans-orm-v1.*
jans-orm-v1.0.0-beta.15
jans-orm-v1.0.0-beta.16
jans-pycloudlib-v1.*
jans-pycloudlib-v1.0.0-beta.13
jans-pycloudlib-v1.0.0-beta.14
jans-pycloudlib-v1.0.0-beta.15
jans-pycloudlib-v1.0.0-beta.16
jans-scim-v1.*
jans-scim-v1.0.0-beta.15
jans-scim-v1.0.0-beta.16
v1.*
v1.0.0-a1
v1.0.0-a2
v1.0.0-beta.15
v1.0.0-beta.16
v1.1.6
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0