CVE-2025-54882: himmelblau-idm himmelblau Insufficiently Protected Credentials
Vulnerability summary
CVE-2025-54882 is a high (CVSS 7.1) Insufficiently Protected Credentials vulnerability in himmelblau-idm himmelblau. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 07-08-2025PublishedVulnerability first disclosed.
- 07-08-2025Last modifiedVulnerability information updated.
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
+0.01 pp
From 0.21% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundHimmelblau
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Himmelblau-idm1 product
- himmelblau≥ 1.0.0-beta, < 1.2.0 | ≥ 0.8.0, < 0.9.22 | ≥ 1.0.0, < 1.2.0
Opensuse1 product
- himmelblau&distro=openSUSE Tumbleweed< 1.2.0+git.0.6befefc-1.1
2 vendors · 2 products
References
6 links- github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83X Refsource CONFIRMExploitVendor Advisory
- github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2adX Refsource MISCPatch
- github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778aX Refsource MISCPatch