Loading vulnerability…
Authentication Token Exposure in Amazon WorkSpaces Client for Linux
CVE-2025-12779 is a high-severity local vulnerability in the Amazon WorkSpaces client for Linux affecting versions 2023.0 through 2024.8. The issue is caused by improper handling of authentication tokens for DCV-based WorkSpaces sessions, which can expose a valid token to other local users on the same client machine. In shared or multi-user Linux environments, an unintended local user may be able to extract another user’s authentication token from the affected client host and use it to authenticate to that user’s WorkSpace. The available reporting indicates the flaw is limited to DCV-based WorkSpaces sessions; PCoIP-based clients are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow one local user on a shared Linux system to impersonate another user’s DCV-based Amazon WorkSpace session. This can result in unauthorized access to the victim’s virtual desktop, including applications, files, and any internal resources reachable through that WorkSpace. The vulnerability is not described as remotely exploitable, but it can lead to account/session compromise within affected shared-client environments.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by preventing untrusted local users from accessing affected Linux client machines, avoiding shared or multi-user use of vulnerable WorkSpaces client versions, and enforcing least-privilege controls on the endpoint. The risk is highest on shared workstations, shared VMs, thin clients, or other environments where multiple local users can access the same system.
Patch, then assume compromise.
Upgrade the Amazon WorkSpaces client for Linux to version 2025.0 or later. AWS states this release addresses the improper token handling issue and improves secure management of authentication tokens for DCV-based WorkSpaces.
No public exploits tracked yet. Mallory keeps watching.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.