{"id":"CVE-2025-53003","aliases":["GHSA-373j-mhpf-84wg"],"url":"https://o3.security/vulnerability/CVE-2025-53003","summary":"Janssen Config API returns results without scope verification","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nThe configAPI is an internal service and hence should never be exposed to the internet. With that said, this is a serious vulnerability that has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc.\n\nThis affects all users of Janssen <1.8.0 and Gluu Flex <5.8.0\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nAll users are advised to upgrade immediately to [1.8.0](https://github.com/JanssenProject/jans/releases/tag/v1.8.0) for Janssen users and [5.8.0](https://github.com/GluuFederation/flex/releases/tag/v5.8.0) For Flex users.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nThe user can potentially fork and build the config api and patch it in their system following the commit here https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1\n\n### References\n_Are there any links users can visit to find out more?_\nhttps://github.com/JanssenProject/jans/issues/11575\nhttps://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1","published":"2025-07-01T01:22:05.855Z","modified":"2026-10-28T11:00:07.219815192Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.jans:jans-config-api-server","fixedVersion":"1.8.0"}],"fix":{"url":"https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1","label":"JanssenProject/jans@92eea4d"},"references":[{"type":"WEB","url":"https://github.com/JanssenProject/jans/releases/tag/v1.8.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53003.json"},{"type":"ADVISORY","url":"https://github.com/JanssenProject/jans/security/advisories/GHSA-373j-mhpf-84wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53003"},{"type":"REPORT","url":"https://github.com/JanssenProject/jans/issues/11575"},{"type":"FIX","url":"https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1"},{"type":"WEB","url":"https://github.com/GluuFederation/flex/releases/tag/v5.8.0"},{"type":"PACKAGE","url":"https://github.com/JanssenProject/jans"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T11:00:07.219815192Z"}}