CVE-2025-53003 affects the Janssen Project, an open-source identity and access management platform, prior to version 1.8.0. The vulnerability allows unauthenticated access to sensitive information from the Identity Provider (IDP), including client details, user data, and scripts, due to a lack of scope verification in the Config API. Rated with a CVSS score of 8.2 (HIGH), this flaw presents a significant risk of information disclosure with low attack complexity. There is currently no evidence of active exploitation, and no public exploit code or significant community discussion has been observed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| JanssenProject | Jans | < 1.8.0CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.