CVE-2025-54982

Published Aug 5, 2025

Last updated 4 days ago

Zscaler Authentication Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54982 is a vulnerability found in Zscaler Authentication Server, specifically affecting the SAML authentication mechanism. The vulnerability stems from an improper verification of the cryptographic signature on the server-side, which could lead to authentication abuse. The vulnerability is classified as a signature verification issue (CWE-347). Exploitation of this vulnerability is known to be easy and can be initiated remotely. Zscaler has released version 6.2r to address and eliminate this vulnerability.

Description: An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.
Source: cve@zscaler.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.6
Impact score: 5.8
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

cve@zscaler.com: CWE-347

Hype score: Not currently trending

References