EUVD-2026-29703Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network vector, no privileges needed, but requires user interaction and specific URL crafting (AC:H); only confidentiality impacted via PRT token leak.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1.
AnalysisAI
linux-entra-sso, Siemens' Chrome browser extension for Microsoft Entra ID SSO on Linux, leaks the Entra ID Primary Refresh Token (PRT) cookie to attacker-controlled hosts due to missing URL origin validation in its Chrome adapter. Versions prior to 1.8.1 are affected; the Chrome adapter's declarativeNetRequest rule uses an unanchored urlFilter that performs substring matching, causing the PRT injection to fire on any request URL containing 'https://login.microsoftonline.com/' anywhere in the path - not just requests actually destined for Microsoft's login endpoint. A proof-of-concept exists per SSVC data, though exploitation is not confirmed in CISA KEV and EPSS is very low (0.03%), reflecting the niche product footprint and required user interaction.
Technical ContextAI
The Chrome extension (cpe:2.3:a:siemens:linux-entra-sso:*:*:*:*:*:*:*:*) registers a declarativeNetRequest rule via the Chrome Extensions API with a urlFilter of 'https://login.microsoftonline.com/*'. Chrome's urlFilter, when not prefixed with '|' (exact anchor) or '||' (domain anchor), performs substring matching against the full request URL rather than prefix matching against the origin. The rule's modifyHeaders action appends the Entra ID Primary Refresh Token cookie to every matched request. The Firefox adapter at platform/firefox/js/platform-firefox.js:53 mitigates this by performing an explicit startsWith(Platform.SSO_URL) check before header injection; the Chrome adapter at platform/chrome/js/platform-chrome.js:69-88 omits this guard entirely. The manifest declares optional_host_permissions: ['https://*/*'], granting the extension the ability to modify headers across all HTTPS hosts when those permissions are active. Root cause class is CWE-284 (Improper Access Control) - a missing origin validation step allows the access control policy on a sensitive credential to be circumvented by URL path manipulation.
RemediationAI
Upgrade linux-entra-sso to version 1.8.1, which introduces the missing origin validation in the Chrome adapter to mirror the Firefox adapter's startsWith check. The vendor-released patch is confirmed at GHSA-52rj-42vh-2rxc (https://github.com/siemens/linux-entra-sso/security/advisories/GHSA-52rj-42vh-2rxc). If immediate upgrade is not possible, a compensating control is to revoke the optional broad host permission ('https://*/*') from the extension in Chrome's extension management settings - this prevents the declarativeNetRequest rule from firing on attacker-controlled domains, though it may break SSO flows that rely on those permissions. Alternatively, switching to the Firefox adapter eliminates the vulnerability on unpatched versions. Organizations should also consider rotating Entra ID PRT credentials for any users who may have been exposed.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today