Resource exhaustion in Red Hat Connectivity Link 1
CVE-2025-25207
The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.
EPSS: 0.003 (20.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2025-25207?
- CVE-2025-25207 is a medium-severity vulnerability in Red Hat Connectivity Link 1, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.7/10. Published 2025-06-09.
- How severe is CVE-2025-25207?
- Medium severity. CVSS v3 base score is 5.7 out of 10.