EUVD-2026-38086
GHSA-rfvj-frr3-5qvh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable auth bypass in an identity provider yields PR:N/UI:N/AC:L; scope changes because compromised IdP impacts downstream relying parties with full CIA loss.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Azure Active Directory allows unauthenticated remote attackers to bypass authentication controls and gain elevated access across tenant boundaries. With a maximum CVSS score of 10.0 and a scope-changing impact, successful exploitation could compromise identity, access, and resources federated through Azure AD. No public exploit identified at time of analysis, but the trivial attack complexity and network-reachable vector make this a top-priority issue for any organization relying on Azure AD for identity.
Technical ContextAI
Azure Active Directory (now branded Microsoft Entra ID) is Microsoft's cloud identity and access management service used to authenticate users and applications across Microsoft 365, Azure, and federated third-party SaaS. The root-cause class CWE-287 (Improper Authentication) means the service fails to correctly verify that a principal is who it claims to be - examples include token validation flaws, missing signature checks, replayable assertions, or logic errors that accept malformed credentials. Because Azure AD issues OAuth 2.0/OIDC tokens and SAML assertions consumed by downstream resources, an authentication flaw at the identity provider cascades into any application trusting those tokens. No specific CPE strings were provided in the input to narrow the affected component (sign-in service, token issuance, B2B/B2C, federation, etc.).
RemediationAI
Because Azure AD is a Microsoft-operated cloud service, the primary remediation path is server-side mitigation by Microsoft rather than a customer-installed patch; patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45480, which customers should review to confirm whether tenant action (e.g., rotating refresh tokens, revoking sessions, updating libraries like MSAL/ADAL, or reconfiguring federation) is required. As compensating controls while validating the fix, enforce Conditional Access policies that require compliant devices and trusted network locations, require phishing-resistant MFA (FIDO2/Windows Hello) for privileged roles, restrict legacy authentication protocols, and monitor sign-in logs for anomalous token issuance - note that aggressive conditional access can break legitimate B2B/guest workflows and service principal authentications, so test in report-only mode first. Consider revoking all refresh tokens for privileged accounts via Revoke-AzureADUserAllRefreshToken to force re-authentication once Microsoft confirms the issue is remediated.
More in Azure Active Directory
View allPrivilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacke
Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrup
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as
Denial of service in Microsoft Azure Active Directory (Entra ID) allows a remote unauthenticated attacker to send networ
Microsoft Azure Active Directory B2C Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is rem
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today