ByteOS Network

CVE Vulnerability Details :

CVE-2025-54781

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-01 Aug, 2025 | 23:35

Updated At-04 Aug, 2025 | 15:26

▼CVE Numbering Authority (CNA)

Himmelblau leaks an Intune service access token in its logs

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the host's Intune compliance status, and may permit additional administrative operations for the Intune host device (though the API for these operations is undocumented). This is fixed in version 1.1.0. To workaround this issue, ensure that Himmelblau debugging is disabled.

Affected Products

Vendor

himmelblau-idm

Product

himmelblau

Versions

Affected

>= 1.0.0, < 1.1.0

Problem Types

Type	CWE ID	Description
CWE	CWE-532	CWE-532: Insertion of Sensitive Information into Log File

Metrics

Version	Base score	Base severity	Vector
3.1	2.8	LOW	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

References

Hyperlink	Resource
https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-78qg-vmrw-574w	x_refsource_CONFIRM
https://github.com/himmelblau-idm/himmelblau/commit/2d512bded90ac6a54fcdf737b43ff5d9d4cdb59e	x_refsource_MISC
https://github.com/himmelblau-idm/himmelblau/releases/tag/1.1.0	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References