A critical security flaw has been discovered in the UK government’s Gov.uk One Login digital identity system. The vulnerability was uncovered during a red teaming exercise conducted by cybersecurity consultancy Cyberis in March of this year and reportedly allows unauthorized access to privileged system functions without triggering security monitoring alerts. The discovery raises fresh concerns about the system’s readiness as it becomes increasingly central to digital access for public services in the UK.
Penetration Testing Reveals Systemic Risk
As Computer Weekly reports, the red team assessment was part of a routine security evaluation commissioned by the Government Digital Service (GDS) and the Department for Science, Innovation and Technology (DSIT). While full technical details have not been disclosed, officials confirmed that the flaw could expose sensitive data, system-level software, and backend functionality to attackers if exploited. A government spokesperson said the issue is being addressed as a priority, adding, “Delivering best practice, we routinely conduct red teaming exercises to test security infrastructure. Where issues are found, we work urgently to resolve them.”
The report arrives amid the news that Gov.uk One Login lost its certification under the Digital Identity and Attributes Trust Framework (DIATF). That loss stemmed not from internal technical failings but from a key supplier allowing its certification to lapse—a development that nonetheless underscores the fragility of the system’s supply chain and governance model.
Growing Scrutiny Over Governance and Compliance
In November 2022, the Cabinet Office flagged serious data protection failings in the system, and in September 2023, the National Cyber Security Centre (NCSC) warned of significant architectural shortcomings that could leave One Login vulnerable to identity theft.
Despite ongoing development efforts, One Login currently meets only 21 of 39 outcomes under the NCSC’s Cyber Assessment Framework, according to recent parliamentary disclosures. Furthermore, the platform still lacks critical architectural safeguards, such as Privileged Access Workstations (PAWs), which are recommended by the NCSC for secure system administration.
Baroness Maggie Jones, responding to questions in the House of Lords, noted that the government is working with the NCSC to mitigate insider threats, is undergoing external IT health checks, and is collaborating with the Information Commissioner’s Office on data protection practices. However, the platform has not fully adopted the Secure by Design principles that GDS claims to support.
Expansion Plans Add Pressure
The timing of this discovery is especially consequential. One Login now serves more than six million users and provides access to over 50 government services. It has recently been integrated with Companies House for business identity verification and is set to underpin the forthcoming Gov.uk Wallet initiative, which will store digital versions of official documents such as driving licences. The presence of an unresolved privilege escalation flaw raises questions about the system’s ability to securely manage sensitive personal data as its role expands.
The government has emphasized existing controls, including identity and access management policies, security clearance requirements for personnel, system architecture standards, deployment oversight, and detailed logging procedures. Nevertheless, the emerging pattern of compliance gaps and vulnerability disclosures suggests that deeper structural and procedural reforms may be needed before One Login can be considered a mature and resilient digital identity platform.
Source: ComputerWeekly
—
May 16, 2025 – by Ali Nassar-Smith
