CVE-2025-56689
Quest One Identity MFA Bypass Remote Authentication Bypass
Description
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.)
INFO
Published Date :
Sept. 3, 2025, 5:15 p.m.
Last Modified :
Sept. 16, 2025, 4:15 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source | 
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 
Solution
- Update Quest One Identity to a patched version.
- Verify OTP enforcement on MFA pages.
- Review access logs for suspicious activity.
References to Advisories, Solutions, and Tools
                                            Here, you will find a curated list of external links that provide in-depth
                                            information, practical solutions, and valuable tools related to
                                            CVE-2025-56689.
                                        
| URL | Resource | 
|---|---|
| https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453 | Exploit Third Party Advisory | 
CWE - Common Weakness Enumeration
            While CVE identifies
            specific instances of vulnerabilities, CWE categorizes the common flaws or
            weaknesses that can lead to vulnerabilities. CVE-2025-56689 is
            associated with the following CWEs:
        
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
            (CAPEC)
            stores attack patterns, which are descriptions of the common attributes and
            approaches employed by adversaries to exploit the CVE-2025-56689
            weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
			The following list is the news that have been mention
			CVE-2025-56689 vulnerability anywhere in the article.
		
                The following table lists the changes that have been made to the
                CVE-2025-56689 vulnerability over time.
            
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
- 
                            CVE Modified by [email protected]Sep. 16, 2025 Action Type Old Value New Value Added Tag disputed Changed Description One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.) 
- 
                            Initial Analysis by [email protected]Sep. 09, 2025 Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:quest:one_identity:7.5.1.20903:*:*:*:*:*:*:* Added Reference Type MITRE: https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453 Types: Exploit, Third Party Advisory 
- 
                            CVE Modified by [email protected]Sep. 08, 2025 Action Type Old Value New Value Changed Description An issue was discovered in Quest One Identity 7.5.1.20903. A crafted response manipulation can bypass the OTP on MFA page which leads to access the PAM portal without OTP allowing attackers to control an arbitrary account. One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. 
- 
                            CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0Sep. 03, 2025 Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L Added CWE CWE-290 
- 
                            New CVE Received by [email protected]Sep. 03, 2025 Action Type Old Value New Value Added Description An issue was discovered in Quest One Identity 7.5.1.20903. A crafted response manipulation can bypass the OTP on MFA page which leads to access the PAM portal without OTP allowing attackers to control an arbitrary account. Added Reference https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453 
 
                         
                         
                         
                                             
                                            