CVE-2025-25207Medium· 5.7▾ SunlitThe Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.
rhcl-operator-container 1.0.1rhcl-operator-container (all versions)rhoai/odh-model-controller-rhel9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-25208Medium· 5.7Rhcl: authorino denial of service through authpolicy with sharedsecretref severity
CVE-2025-2559Medium· 4.9A flaw was found in Keycloak
CVE-2025-14525Medium· 6.4A flaw was found in kubevirt
CVE-2025-12748Medium· 5.5A flaw was discovered in libvirt in the XML file processing
CVE-2025-4432Medium· 5.3A flaw was found in Rust's Ring package
CVE-2025-32049High· 7.5A flaw was found in libsoup