---
id: CVE-2025-5279
aliases:
  - GHSA-r244-wg5g-6w2r
  - PYSEC-2026-1867
title: >-
  Issue with Amazon Redshift Python Connector and the
  BrowserAzureOAuth2CredentialsProvider plugin
summary: >-
  Issue with Amazon Redshift Python Connector and the
  BrowserAzureOAuth2CredentialsProvider plugin
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: redshift-connector
product: redshift-connector
ecosystem: pip
affected:
  - 'redshift-connector >= 2.0.872, < 2.1.7'
patched:
  - redshift-connector 2.1.7
published: '2025-05-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:24.760378818Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-r244-wg5g-6w2r'
references:
  - url: >-
      https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-r244-wg5g-6w2r
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5279'
  - url: 'https://aws.amazon.com/security/security-bulletins'
  - url: 'https://aws.amazon.com/security/security-bulletins/AWS-2025-011'
  - url: 'https://github.com/aws/amazon-redshift-python-driver'
  - url: 'https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.7'
tags:
  - osv
  - pip
epss: 0.00298
epssPercentile: 0.20021
ingestedAt: '2026-07-08T18:25:52.509Z'
---

## Overview

### Summary
[Amazon Redshift Python Connector](https://docs.aws.amazon.com/redshift/latest/mgmt/python-redshift-driver.html) is a pure Python connector to Redshift (i.e., driver) that implements the [Python Database API Specification 2.0](https://www.python.org/dev/peps/pep-0249/).

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. 

### Impact

An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token.

**Impacted versions:** >=2.0.872;<=2.1.6

### Patches

Upgrade Amazon Redshift Python Connector to version 2.1.7 and ensure any forked or derivative code is patched to incorporate the new fixes.

### Workarounds

None

### References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

## Affected packages

- `redshift-connector >= 2.0.872, < 2.1.7`

## Remediation

Upgrade to a patched release:

- `redshift-connector 2.1.7`