CVE-2025-53003

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.

• CWE-200
• CWE-269
• CWE-284

• https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1
• https://github.com/JanssenProject/jans/issues/11575
• https://github.com/JanssenProject/jans/releases/tag/v1.8.0
• https://github.com/JanssenProject/jans/security/advisories/GHSA-373j-mhpf-84wg
• https://github.com/JanssenProject/jans/issues/11575

Published

Jul 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52997File Browser provides a file managing interface within a spe…7.5
• CVE-2025-52998Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-52999jackson-core contains core low-level incremental ("streaming…8.7
• CVE-2025-53000The nbconvert tool, jupyter nbconvert, converts Jupyter note…7.8
• CVE-2025-53001Rejected reason: Reason: This candidate was issued in error.
• CVE-2025-53002LLaMA-Factory is a tuning library for large language models.…9.8
• CVE-2025-53004DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-53005DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-53006DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-53007arduino-esp32 provides an Arduino core for the ESP32. Versio…8.9
• CVE-2025-53008GLPI stands for Gestionnaire Libre de Parc Informatique is a…6.5
• CVE-2025-53009MaterialX is an open standard for the exchange of rich mater…7.5