What is the CVSS score of CVE-2025-54603?

CVE-2025-54603 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Claroty Secure Access are affected by CVE-2025-54603?

Claroty Secure Access (versions 3.3.0-4.0.2) contains an authentication bypass in its OpenID Connect login flow that permits remote attackers to create unauthorized accounts or impersonate legitimate…

How to fix or mitigate CVE-2025-54603?

Within 24 hours: Inventory all Claroty Secure Access deployments to identify affected versions (3.3.0-4.0.2); if operationally feasible, restrict network access to SRA interfaces and consider temporarily disabling OIDC federation to use alternate authentication methods. Within 7 days: Deploy enhanced logging and alerting for suspicious account creation and user impersonation attempts; audit existing OIDC-federated accounts for unauthorized modifications and review session logs for anomalous access patterns from unexpected IP addresses. Within 30 days: Apply vendor patch immediately upon release; conduct security re-attestation of all OIDC federation trust policies; enforce multi-factor authentication on all SRA administrative accounts; and implement IP whitelisting restrictions for remote access connectivity.

Claroty Secure Access CVE-2025-54603

CRITICAL

Improper Access Control (CWE-284)

2025-10-14 cve@mitre.org

Authentication Bypass

9.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.9 HIGH

Network, unauthenticated, no UI; AC:H because exploitation requires OIDC configured and crafting valid assertions; S:C as the auth broker fronts other systems; C:H/I:H via impersonation, A:L (indirect).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 08, 2026 - 17:30 vuln.today

CVE Published

Oct 14, 2025 - 17:15 cve.org

CRITICAL 9.0

DescriptionCVE.org

An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users.

AnalysisAI

Authentication bypass in Claroty Secure Access (formerly SRA) versions 3.3.0 through 4.0.2 lets a remote attacker abuse a flawed OpenID Connect (OIDC) login flow to create unauthorized accounts or impersonate existing OIDC-federated users. Because Claroty Secure Access brokers privileged remote access into OT/ICS environments, successful impersonation can hand an attacker a legitimate user's (potentially administrative) session. No public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

Claroty Secure Access is a secure remote-access gateway for operational technology / industrial control environments, supporting federated single sign-on via OpenID Connect. The root cause is CWE-284 (improper access control) manifesting specifically in the OIDC authentication handshake - the flow does not correctly validate the identity assertions returned by the identity provider (e.g., issuer/audience/subject binding), so an attacker can cause the platform to provision a new user or bind their session to an existing OIDC identity. The referenced vendor guidance (claroty.com/product-security/oidc-configurations-in-claroty-secure-access) indicates the defect is tied to how OIDC is configured and how returned claims are trusted.

Affected ProductsAI

Claroty Secure Access versions 3.3.0 through 4.0.2 are affected. No CPE string was provided in the intelligence data. Vendor references are the general product-security landing page (https://claroty.com) and the specific advisory at https://claroty.com/product-security/oidc-configurations-in-claroty-secure-access; consult the latter for the exact fixed build and configuration hardening steps.

RemediationAI

Upgrade beyond the affected 3.3.0-4.0.2 range to the fixed release identified in Claroty's advisory (https://claroty.com/product-security/oidc-configurations-in-claroty-secure-access) - an exact fix version was not provided in the input, so confirm the precise patched build directly with Claroty. As compensating controls until patched: review and harden the OIDC configuration per the vendor's guidance (ensure issuer, audience, and subject/claim validation are strictly enforced), and if feasible temporarily disable OIDC federation in favor of a local or alternative authentication method - noting this will disrupt SSO for legitimate users. Restrict network reachability of the Secure Access management/login interface to trusted networks or VPN to reduce the unauthenticated remote attack surface.