EUVD-2026-31519
GHSA-5gj2-5693-p684
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable authentication bypass needing no privileges or user interaction (AV:N/AC:L/PR:N/UI:N); a full identity-layer bypass yields total confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Azure Active Directory B2C (now part of Microsoft Entra) lets a remote, unauthenticated attacker bypass authentication by abusing an alternate path or channel and gain elevated access over the network. Any tenant relying on Entra/Azure AD B2C for customer-facing identity is affected until Microsoft's cloud-side fix is applied or automatically rolled out. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability very low (0.05%), but SSVC flags the technical impact as total and the flaw as automatable.
Technical ContextAI
Azure AD B2C is Microsoft's cloud identity-as-a-service platform for consumer/customer (B2C) authentication, now consolidated under the Microsoft Entra brand (CPE cpe:2.3:a:microsoft:microsoft_entra). The root cause is classified as CWE-288, 'Authentication Bypass Using an Alternate Path or Channel' - a design/logic weakness where a secondary, less-protected code path (for example an alternate endpoint, token flow, or channel) reaches privileged functionality without enforcing the primary authentication checks. Because B2C brokers sign-in, token issuance, and policy enforcement for downstream applications, a bypass at this layer can undermine the trust boundary for every relying application that federates through the affected tenant.
RemediationAI
Because Azure AD B2C / Microsoft Entra is a Microsoft-operated cloud service, the primary remediation is the vendor-side fix: Patch available per vendor advisory (Microsoft Security Update Guide, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33843); a specific customer-installable fix version is not applicable and none is enumerated in the input. Administrators should review the MSRC advisory to confirm whether any tenant-side configuration change or action is required and validate that their tenant reflects the remediated service. As defense-in-depth while confirming remediation, restrict and monitor B2C sign-in and token flows: enable and review Entra sign-in and audit logs for anomalous authentication or token issuance, enforce Conditional Access and MFA on downstream applications so a single identity-layer bypass does not grant unfettered access, and tighten any custom-policy or alternate authentication endpoints the tenant exposes. The trade-off of stricter Conditional Access and MFA is added friction for legitimate B2C end users, so scope those policies to sensitive applications.
More in Microsoft Entra
View allRemote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting ma
Server-side request forgery in Microsoft Entra ID Entitlement Management lets a remote, unauthenticated attacker coerce
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged atta
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today