OneLogin AD Connector Vulnerabilities Expose Authentication Credentials

A critical security vulnerability in OneLogin’s Active Directory (AD) Connector service has exposed enterprise authentication systems to significant risk

The flaw, now reportedly fixed, uncovered by SpecterOps allowed malicious actors to obtain authentication credentials, impersonate users, and access sensitive applications through OneLogin’s platform.

OneLogin, a prominent identity and access management (IAM) solution, integrates with popular directory services like Active Directory and AWS to provide single sign-on (SSO) and multi-factor authentication for organizations.

The service’s AD Connector is widely used to synchronize on-premises user directories with cloud platforms.

OneLogin AD Connector Vulnerabilities

Researchers found that attackers could exploit OneLogin’s AD Connector to access crucial credentials and cryptographic keys, enabling them to forge valid JSON Web Tokens (JWTs).

These tokens could be used to impersonate any user in a target domain and gain unauthorized access to enterprise applications.