CVE-2025-68833

HCL Hive is affected by use of a cryptographic primitive with a risky implementation

View on CVE.org
Published Aug 24, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.

Analysis

AI-generated

Technical impact

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control, which could allow an attacker to gain unauthorized access to resources. The vulnerability is classified under CWE‑1240, which is related to improper handling of cryptographic contexts, but the description focuses on access control weaknesses rather than cryptographic manipulation. An attacker who can authenticate or manipulate access tokens may read or alter confidential data beyond their intended scope.

Affected Systems

HCL Software’s HCL Hive Keycloak IAM instance is affected. No specific product versions are listed in the data; any installation of HCL Hive should be evaluated for this flaw.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting that it is not currently a high‑profile exploit target. Based on the description, it is inferred that an attacker could exploit the IAM component’s access control granularity by forging or manipulating authentication tokens to access resources beyond their intended scope.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the HCL Software support site for any available patches or updates for HCL Hive and apply them immediately
  • Reconfigure IAM roles and scopes to enforce least privilege, ensuring that permissions are tightly scoped to necessary resources
  • Implement logging and monitoring of authentication and authorization events to detect anomalous access patterns
  • Conduct a security review of the access control configuration to confirm that role boundaries are correctly enforced

Generated by OpenCVE AI on August 24, 2026 at 20:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hcltech
Hcltech hive
Vendors & Products Hcltech
Hcltech hive
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
Title HCL Hive is affected by use of a cryptographic primitive with a risky implementation
Weaknesses CWE-1240
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-1240

    Use of a Cryptographic Primitive with a Risky Implementation

Sources

Status
PUBLISHED
Assigner
HCL
Published
Updated
Aug 24, 2026, 3:16 PM
Reserved
Dec 24, 2025, 1:23 PM

View source JSON

Updated
Aug 24, 2026, 3:16 PM

JSON

Status
Deferred
Published
Aug 24, 2026, 2:16 PM
Modified
Oct 7, 2026, 9:10 AM

View source JSON

No data.

Updated
Aug 24, 2026, 9:10 PM

JSON