Identity Manager CVE-2025-13478

Without an available CVSS vector or EPSS score, quantitative risk assessment is constrained; however, qualitative signals indicate moderate-to-significant real-world risk. The vulnerability requires remote network access and valid authentication credentials (PR:L minimum), reducing the attack surface compared to unauthenticated flaws. The information disclosure impact is confined to session data rather than arbitrary code execution, limiting technical impact severity. No CISA KEV status or publicly available proof-of-concept has been noted in the input data, suggesting this is not yet confirmed as actively exploited in the wild. However, the logic flaw affects a widely-deployed identity management solution, and session hijacking through cache poisoning is a well-understood attack pattern that defenders and attackers alike prioritize. Organizations managing multiple user sessions should treat this as a medium-to-high priority remediation target, particularly in environments with sensitive or privileged account management.

A remote attacker with valid Identity Manager credentials (e.g., a low-privilege user account) authenticates to the system and makes API or web requests that trigger caching of session data. By manipulating cache retrieval mechanisms or exploiting a race condition in cache lookup, the attacker retrieves cached session tokens or credential material belonging to other users-potentially including administrators or service accounts. The attacker then hijacks or impersonates the victim user's session, gaining unauthorized access to Identity Manager functions and data accessible to that user. No public exploit code has been identified at the time of analysis, though the cache misconfiguration is likely reproducible by skilled attackers familiar with Identity Manager's session and caching architecture.