CVE-2025-49827

creationtimestamp| type| source ---|---|--- 2025-07-16 20:32:46+00:00| seen| https://seclists.org/oss-sec/2025/q3/49 2025-07-18 17:07:26+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3luawokctxi23 2025-08-07 13:45:02+00:00| published-proof-of-concept| https://t.me/truesecator/7...

CVE-2025-49827

CVE-2025-49827 affects CyberArk Conjur OSS (versions 1.19.5–1.22.0) and Secrets Manager, Self-Hosted (13.1–13.5, 13.6). Root cause is bypass of the IAM authenticator via manipulation of AWS-signed headers and a malformed regex that redirects the authentication validation request to a attacker-con...

CVE-2025-49827 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attacker who can manipula...