# CyberArk Conjur IAM authenticator bypass via network device

Source: https://startwithidentity.com/cves/cve-2025-49831/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2025-49831 is the second IAM-authenticator bypass in the Cyata Conjur chain. A misconfigured network device in front of the authenticator lets an attacker satisfy the AWS identity check. CVSS 9.1. Fixed with [CVE-2025-49827](https://startwithidentity.com/cves/cve-2025-49827/) in Conjur OSS 1.22.1 and Secrets Manager 13.6.1.

## Why it matters

Two independent ways to fail the same authenticator is the story. Teams that patched only the regex bug and left the network path alone stayed exposed.

## What to do

- Take the full Conjur/Secrets Manager upgrade, not a hotfix for 49827 alone.
- Review any appliance or proxy that sits in front of Conjur's IAM authenticator. If it can rewrite the STS conversation, it is in scope.

## After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

- **Rotate everything in scope**, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- **Revoke active leases and tokens**, then review the audit device log for reads you cannot attribute to a known workload.
- **Rotate the vault's own credentials**: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- **Rotate downstream credentials the vault brokered**, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/) and [what is secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/).

## Sources

- [NVD: CVE-2025-49831](https://nvd.nist.gov/vuln/detail/CVE-2025-49831)