Microsoft Identity Web
Monthly
In applications that use the Microsoft Identity Web library for authentication and authorization, an attacker who already holds valid low-privilege credentials can tamper with authentication data the library incorrectly assumes is immutable, bypassing authorization checks to read data beyond their granted permissions (CVSS 5.3, C:H/I:N/A:N). Exploitation is not unauthenticated and is constrained by high attack complexity (AC:H), meaning specific conditions, state, or timing must be satisfied rather than a simple repeatable request. At the time of analysis there is no public exploit identified and no confirmed active exploitation, but a vendor patch is available (RL:O), so patched deployments are not affected.
In applications that use the Microsoft Identity Web library for authentication and authorization, an attacker who already holds valid low-privilege credentials can tamper with authentication data the library incorrectly assumes is immutable, bypassing authorization checks to read data beyond their granted permissions (CVSS 5.3, C:H/I:N/A:N). Exploitation is not unauthenticated and is constrained by high attack complexity (AC:H), meaning specific conditions, state, or timing must be satisfied rather than a simple repeatable request. At the time of analysis there is no public exploit identified and no confirmed active exploitation, but a vendor patch is available (RL:O), so patched deployments are not affected.