EUVD-2025-210762
GHSA-x278-8xqr-3rx2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible IAM endpoint, no credentials needed per authentication bypass nature, confidentiality-only impact with no integrity or availability consequence.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
AnalysisAI
Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published.
Technical ContextAI
HCL Hive is an enterprise collaboration and workflow platform that uses Keycloak as its Identity and Access Management (IAM) backend. Keycloak is an open-source IAM solution providing SSO, OAuth2, and OIDC capabilities. CWE-1240 (Use of a Risky Cryptographic Primitive) is listed by NVD, though the description - 'insufficient granularity of access control' - aligns more closely with CWE-1220 (Insufficient Granularity of Access Control). This discrepancy should be noted: either the CWE is incorrectly catalogued, or the cryptographic primitive weakness is the root cause enabling the access control bypass. The affected CPE is cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:* (all versions), indicating no specific version range has been bounded by NVD. The flaw resides in the IAM layer, meaning authorization decisions - rather than the application logic itself - are misconfigured or insufficiently scoped.
RemediationAI
The primary remediation is to consult and apply guidance from HCL's knowledge base article KB0131731 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131731; a specific patched version is not independently confirmed from the available data ('Patch available per vendor advisory'). If immediate patching is not feasible, restrict network access to the HCL Hive Keycloak IAM endpoints using perimeter firewall rules or reverse proxy ACLs so that only authorized internal clients or VPN-connected users can reach the IAM service - this directly reduces the AV:N attack surface but does not eliminate the underlying flaw. Additionally, audit Keycloak realm and client access policies for overly permissive scope assignments and enable Keycloak's fine-grained authorization services if not already active. Monitor Keycloak access logs for anomalous resource access patterns as a detective control.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, contain
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly do
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and in
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to con
HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTT
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today