Microsoft Identity Web EUVD-2026-102953

Exploitation requires the target application to use the Microsoft Identity Web library for authentication/authorization, and the attacker must already possess valid low-privilege authenticated access (PR:L) to that application - this is not unauthenticated. The flaw stems from the library treating certain authentication data as immutable when it is not (CWE-302), so the attacker tampers with that data to bypass authorization. Exploitation is further limited by high attack complexity (AC:H), implying specific conditions, state, or timing must be met rather than a simple repeatable request, and no public exploit exists (E:U). A vendor patch is available (RL:O), so patched deployments are not affected.

This is a moderate-severity (CVSS 5.3), not a top-priority, issue based on the convergence of signals. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) shows a network-reachable flaw but with two meaningful dampeners: high attack complexity (AC:H) and a requirement for existing low privileges (PR:L), meaning the attacker must already be an authenticated/authorized principal. The temporal metrics reinforce low real-world urgency: E:U (exploit code unproven), RL:O (official fix available), and RC:C (confirmed report) - so there is no public exploit identified at time of analysis and a vendor patch exists. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; the AC:H and E:U signals together suggest exploitation would be non-trivial and is not currently observed. Note a tension worth flagging: the description frames this as 'elevate privileges,' which typically implies an integrity impact, yet Microsoft's vector sets I:N and scores only confidentiality (C:H) - verify the precise impact with the vendor advisory, as the impact framing (privilege elevation) and the scored metrics (confidentiality-only) are not fully aligned.

An attacker who already holds a low-privilege authenticated session against an ASP.NET Core application using Microsoft Identity Web manipulates data the library incorrectly assumes to be immutable (CWE-302), causing the authentication/authorization logic to grant access it should not. Because attack complexity is high (AC:H), the attacker likely needs specific conditions or timing to win the bypass. No public exploit code exists (E:U), so this would currently require original exploit development.