CVE-2025-12779

HIGH

Amazon WorkSpaces client <2024.8 - Info Disclosure

Title source: llm

Description

Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract another local user's authentication token from the shared client machine and access their WorkSpace. To mitigate this issue, users should upgrade to the Amazon WorkSpaces client for Linux version 2025.0 or later.

References (2)

[Various Sources] https://aws.amazon.com/security/security-bulletins/AWS-2025-025/

[Various Sources] https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes

Scores

CVSS v3 8.8

EPSS 0.0002

EPSS Percentile 5.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-497

Status published

Products (1)

Amazon/Amazon WorkSpaces 2025.0

Published Nov 05, 2025

Tracked Since Feb 18, 2026