CVE-2025-49827

Name of the Vulnerable Software and Affected Versions Conjur OSS versions 1.19.5 through 1.22.0 Secrets Manager, Self-Hosted versions 13.1 through 13.6

Description Conjur provides secrets management and application identity for infrastructure. A malformed regular expression allows an attacker manipulating headers signed by AWS to redirect the authentication validation request sent by Secrets Manager, Self-Hosted to a malicious server. This redirection could bypass the IAM Authenticator, granting the attacker permissions granted to the client whose request was manipulated.

Recommendations Conjur OSS version 1.22.1 or later Secrets Manager, Self-Hosted version 13.5.1 or later Secrets Manager, Self-Hosted version 13.6.1 or later