Date: 2025-10-22
Updated: 2025-12-03
HIGH risk vulnerability concerning INDIGO IAM where a a protected
resource client can obtain tokens using the client-credentials flow.
EGI SVG ID : EGI-SVG-2025-19
CVE ID : N/A
CVSS Score : N/A
All releases of INDIGO IAM up to and including version 1.12.2.
Sites are recommended to update relevant components
using information in the references below, if they have
not already updated to version 1.12.3 or later
Update INDIGO IAM to release 1.12.3 or later [R 3]
See references below for further information
There is no mitigation.
Note that this is fixed in the same release as a previous ‘MODERATE’
risk vulnerability. So sites who have acted on EGI-SVG-2025-18 should
already not be vulnerabile.
TLP:CLEAR information - Un;imited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2025-19
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. ---
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
(see [R 99] for further details, and other information on SVG)