EUVD-2026-50216

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

The CVE affects the Apache Airflow FAB provider’s FAB auth manager, where Azure AD OAuth login decodes the ID token with verify_signature defaulting to False. This allows an attacker with a forged or unsigned (alg:none) ID token to bypass authentication and log in as any user, including Admin. Af...

PT-2026-60486

Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...

BIT-PROMETHEUS-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

CVE-2026-50652

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50653

CVE-2026-50653 describes an infinite loop with an unreachable exit condition in Azure Active Directory that can allow a network-based denial of service. The provided documents confirm the issue and its impact as a denial of service via network, but do not include specific exploitation details, af...

CVE-2026-50653

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50652

CVE-2026-50652: A deserialization of untrusted data flaw in Azure Active Directory enables a network-based Denial of Service. The vulnerability is triggered remotely (network vector), requires no authentication and no user interaction, and results in availability impact (A:H) with no confidential...

CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50652

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

Azure Active Directory Denial of Service Vulnerability

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

Azure Active Directory Denial of Service Vulnerability

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

PT-2026-58210

Name of the Vulnerable Software and Affected Versions Azure Active Directory versions prior to 8.19.2 Description An infinite loop occurs when an unreachable exit condition is triggered, allowing an unauthorized attacker to remotely cause a denial of service over a network. Recommendations Update...

KLA91142 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Monitor Agent Metri...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...