Description

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-03T23:17:20.500Z",
  "pubdate": "2026-09-03T23:17:20.500Z",
  "executiveSummary": "This vulnerability involves an authorization bypass flaw identified within Microsoft Azure Active Directory B2C, specifically related to the handling of user-controlled keys.\nThe vulnerability allows an unauthorized remote attacker to manipulate session or access validation mechanisms by injecting or altering parameters controlled by the user.\nThe primary impact of this security deficiency is unauthorized privilege escalation, enabling an attacker to assume elevated roles or access restricted resources within the B2C directory environment.\nThe flaw affects Microsoft Azure Active Directory B2C services, posing a significant risk to organizational identity and access management security postures.\nSuccessful exploitation requires the attacker to have the capability to influence or provide input to the identity validation process, effectively circumventing established authorization checks.\nThis vulnerability compromises the integrity of the authentication flow, potentially granting attackers administrative control over user objects or application integrations without possessing valid credentials for the targeted privilege level.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of authorization logic within the Microsoft Azure Active Directory B2C service, specifically concerning how the system validates and trusts user-provided keys during token acquisition or session management flows.\nThe vulnerable component involves the logic responsible for parsing and verifying cryptographic identifiers or metadata tokens that are accepted as user input. Instead of enforcing strict server-side validation against a trusted authority or a cryptographically signed secure store, the system incorrectly trusts the key material provided by the client-side entity.\nThe attack flow commences when an attacker identifies an endpoint or service request where user-controlled input acts as a key identifier for session or claim validation. By supplying a malicious, crafted key—or leveraging an existing key that does not correspond to their authorized scope—the attacker forces the service to process the request using this provided input.\nDue to the failure in the validation mechanism, the service fails to verify the authenticity or the binding of the provided key to the authenticated user's identity. Consequently, the identity provider incorrectly elevates the session claims, associating them with higher-privilege scopes or administrative identities than those associated with the original request.\nTechnically, this manifests as an object-level authorization bypass where the backend server fails to verify if the user-controlled key is authorized to access the requested resource or perform the requested action. The payload behavior involves the submission of intercepted or forged identifiers during the token exchange or validation phase. If the system incorrectly trusts the provided key, it generates a response indicating successful authentication or authorization for an elevated privilege set.\nThe post-exploitation impact includes unauthorized access to sensitive user data, the ability to modify directory configurations, or the provisioning of additional malicious access credentials within the tenant. The vulnerability is highly critical because it circumvents the fundamental trust model required for secure identity federation, effectively allowing attackers to bypass multi-factor authentication or conditional access policies by masquerading as highly privileged service principals or administrative users."
}