CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Authentication Bypass in Claroty Secure Remote Access

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Claroty has patched an authentication bypass flaw (CVE-2025-54603) in its Secure Remote Access (SRA) product. The vulnerability, discovered by Limes Security, allowed attackers to create unauthorized users, impersonate existing users, and gain full admin control. The flaw affects the on-premises OpenID Connect (OIDC) feature in Claroty SRA versions 3.3.0 through 4.0.2. The vulnerability stems from an incorrect implementation of the OIDC authentication flow, enabling attackers to bypass authentication mechanisms and potentially circumvent multifactor authentication. Claroty SRA is used by hundreds of organizations to secure critical OT assets across thousands of sites globally. The flaw was discovered during a routine penetration test and was reported to Claroty earlier this year. The vendor has since released a patch to mitigate the risk.

Timeline

  1. 30.10.2025 22:29 1 articles · 11d ago

    Authentication Bypass in Claroty Secure Remote Access

    Claroty has patched an authentication bypass flaw (CVE-2025-54603) in its Secure Remote Access (SRA) product. The vulnerability, discovered by Limes Security, allows attackers to create unauthorized users, impersonate existing users, and gain full admin control. The flaw affects the on-premises OpenID Connect (OIDC) feature in Claroty SRA versions 3.3.0 through 4.0.2. The vulnerability was discovered during a routine penetration test and was reported to Claroty earlier this year. The vendor has since released a patch to mitigate the risk.

    Show sources
    Open in new tab

Information Snippets

  • CVE-2025-54603 affects Claroty Secure Remote Access (SRA) versions 3.3.0 through 4.0.2.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • The vulnerability allows attackers to create unauthorized users and impersonate existing users.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • The flaw can be exploited to gain full admin control over the affected systems.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • The vulnerability was discovered by Limes Security during a routine penetration test.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • Claroty SRA is used by hundreds of organizations to secure critical OT assets.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • The flaw can bypass multifactor authentication if enabled.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • The vulnerability is relatively trivial to exploit once the specific fields or values to manipulate during the authentication process are known.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources

  • Disabling OIDC is not sufficient to mitigate the risk; a patch from Claroty is required.

    First reported: 30.10.2025 22:29
    1 source, 1 article
    Show sources