A comprehensive security investigation revealed critical vulnerabilities in OneLogin’s Active Directory (AD) Connector service, exposing authentication credentials and enabling attackers to impersonate legitimate users across enterprise environments. The vulnerabilities allowed threat actors to generate valid JSON Web Tokens (JWT) and gain unauthorized access to customer systems. The exposed credentials included cleartext AWS credentials, API keys, and cryptographic signing keys, leading to widespread unauthorized access across an organization's federated applications. This demonstrated a complete compromise scenario, highlighting systemic issues in OneLogin’s infrastructure management.

The OneLogin firm declared that it had found evidence of unauthorised access to its US-based systems. After a review by the organisation, it was determined that a threat actor had access to a set of AWS keys and had utilised them to access the AWS API through an intermediary host that was hosted by a different, smaller US service provider. Regarding the weaknesses that hackers used to gain access to the organisation, nothing is known. OneLogin attested to the encryption of the data, but it also noted that threat actors may still be able to decrypt it.

OneLogin, a cloud-based single sign-on and identity management service provider with over 1400 enterprise customers in 44 countries, suffered from a data breach incident. An unauthorized user gained access to the system by compromising a OneLogin employee’s password for the system. A bug that encrypted the data after that notes visible in the logging system and stored in the hackers database.