HCL Hive EUVD-2025-210762

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special prerequisites - exploitation requires only network reachability to the HCL Hive Keycloak IAM instance. No authentication is required per the PR:N metric, and no specific non-default configuration is indicated by AC:L. Exploitation is limited to a confidentiality impact of Low (C:L), meaning attackers can read some unauthorized data but cannot modify or delete resources (I:N/A:N). The scope of accessible resources is constrained by Keycloak's resource definitions and realm boundaries. Deployments that restrict Keycloak IAM endpoint exposure to internal networks or VPNs significantly reduce the practical attack surface despite the network-vector rating.

The CVSS base score of 5.3 (Medium) reflects a network-accessible, zero-complexity, unauthenticated path to limited confidentiality impact with no integrity or availability consequence. The PR:N metric is notable for an access control flaw - it implies either a complete authentication bypass or a pre-authentication resource exposure, rather than a privilege escalation within an authenticated session. No EPSS data was provided in the intelligence input; without it, quantitative exploitation probability cannot be assessed. No KEV listing and no public POC exist at time of analysis, suggesting this is not currently under active exploitation. Real-world risk is tempered by HCL Hive's relatively niche enterprise deployment footprint; widespread opportunistic scanning is unlikely but targeted attacks against HCL Hive customers remain plausible. The CWE mismatch (CWE-1240 vs. the described access control weakness) introduces uncertainty about the precise technical root cause, which could affect accurate compensating control selection.

A remote, unauthenticated attacker sends a crafted HTTP request to the HCL Hive Keycloak IAM endpoint, exploiting the coarse-grained access control logic to retrieve a resource (such as a token endpoint response, user attribute, or realm configuration) that should require authentication or elevated scope. Because the CVSS vector specifies AC:L and PR:N, no special conditions or valid credentials are needed, making this accessible to any attacker with network reachability to the IAM instance. No public exploit code is known at this time, but the low complexity rating suggests the technique is straightforward to replicate once discovered.