CVE-2025-56689: Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 4.6 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 1.3% chance of exploitation in 30 days – higher than 71% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 3 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should implement the following specific measures: 1) Enforce strict network segmentation and encryption (e.g., TLS 1.3) to prevent interception or capture of OTP responses and authentication cookies. 2) Monitor and restrict access to the Safeguard appliance to trusted networks and devices, minimizing exposure to interception threats. 3) Implement short validity intervals for authentication cookies to reduce the window of opportunity for replay attacks. 4) Enable additional layers of authentication or anomaly detection, such as device fingerprinting or behavioral analytics, to detect suspicious reuse of authentication tokens. 5) Regularly audit and review privileged access logs for unusual authentication patterns indicative of replay attempts. 6) Engage with the vendor to obtain updates or patches addressing this issue or to clarify recommended secure configurations. 7) Consider deploying compensating controls such as hardware-based MFA tokens or out-of-band verification methods that are less susceptible to interception and replay. 8) Train administrators and users on the risks of interception and the importance of secure handling of authentication credentials. These targeted actions go beyond generic advice by focusing on reducing interception risk, tightening session management, and enhancing detection capabilities specific to this vulnerability's exploitation vector.
Description
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.)