New “BodySnatcher” Flaw Allows Full ServiceNow User Impersonation

A security researcher disclosed a critical vulnerability dubbed 'BodySnatcher' (CVE-2025-12420) affecting ServiceNow's Virtual Agent API and Now Assist AI Agents on on‑premise deployments; the flaw uses a globally shared static client secret plus an email-based auto-linking mechanism to allow unauthenticated attackers to impersonate any user, bypass MFA/SSO, execute privileged AI workflows, and create backdoor administrator accounts. Proof-of-concept exploitation demonstrated account creation, privilege escalation, and full platform access; ServiceNow released patches for affected versions and customers are advised to upgrade, enforce MFA on agent linking, require approval workflows, and audit/deactivate unused AI agents.