Azure Active Directory B2C
Monthly
Privilege elevation in Microsoft Azure Active Directory B2C lets an unauthenticated remote attacker abuse a user-controlled key (CWE-639) to bypass authorization checks and gain elevated privileges across a network. The flaw carries a maximum CVSS 10.0 with a changed scope, reflecting that a successful attack against the shared identity platform can compromise the confidentiality and integrity of resources belonging to other principals or tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege elevation in Microsoft Azure Active Directory B2C lets an unauthenticated remote attacker abuse a user-controlled key (CWE-639) to bypass authorization checks and gain elevated privileges across a network. The flaw carries a maximum CVSS 10.0 with a changed scope, reflecting that a successful attack against the shared identity platform can compromise the confidentiality and integrity of resources belonging to other principals or tenants. No public exploit identified at time of analysis, and it is not listed in CISA KEV.