Securden Unified PAM - Authentication Bypass

criticalseverity

35.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.

Impact

Unauthenticated attackers can control administrator backup functions to compromise passwords, secrets, and application session tokens stored in Unified PAM.

Fix

Upgrade Securden Unified PAM to the latest version that implements proper authentication checks on backup functions.

How to confirm it

Send: GET /thirdparty-access
Positive when: status_code == 302
Send: GET /get_csrf_token
Positive when: status_code == 200 and contains(body, 'token') and contains(content_type, 'application/json')
Send: GET /get_date_picker_format
Positive when: status_code == 200 and contains(body, 'current_date') and contains(content_type, 'application/json')

Run it with nuclei: nuclei -id CVE-2025-53118 -u <target>

The full check

id: CVE-2025-53118

info:
  name: Securden Unified PAM - Authentication Bypass
  author: DhiyaneshDk,pussycat0x,iamnoooob,pdresearch
  severity: critical
  description: |
    An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
  impact: |
    Unauthenticated attackers can control administrator backup functions to compromise passwords, secrets, and application session tokens stored in Unified PAM.
  remediation: |
    Upgrade Securden Unified PAM to the latest version that implements proper authentication checks on backup functions.
  reference:
    - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53118
  metadata:
    verified: true
    max-request: 3
    fofa-query: (icon_hash="1798893256" || icon_hash="-766529773")
  tags: cve,cve2025,securden,pam,auth-bypass,vuln,vkev

flow: http(1) & http(2) & http(3)

http:
  - raw:
      - |
        GET /thirdparty-access HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
        internal: true

  - raw:
      - |
        GET /get_csrf_token HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'token')
          - contains(content_type, 'application/json')
        condition: and
        internal: true

  - raw:
      - |
        GET /get_date_picker_format HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'current_date')
          - contains(content_type, 'application/json')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from