65 matches found
CVE-2026-50338
CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...
Microsoft Azure Active Directory B2C Authentication Bypass Privilege Escalation
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to the bypassing of authentication processes by using a user-controlled key. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-70795
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-83711
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-83711
Microsoft Azure Active Directory B2C is affected by an authorization bypass vulnerability caused by a user-controlled key, enabling an unauthorized attacker to elevate privileges over the network. The vulnerability is rated CVSS 3.1 10.0 (Critical) with no privileges required , no user interactio...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
PT-2026-85314
Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authorization bypass exists in cloud identity deployments supporting public-facing authentication flows. This issue occurs due to a user-controlled key, which...
Salesforce B2C Commerce WebDAV - Detection
Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response.""" from kittysploit import from lib.protocols.http.httpclient import...
Spring Cloud Azure B2C CVE-2026-50338 Detection
Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...
Spring Cloud Azure B2C Cross-Issuer Auth Bypass (CVE-2026-50338)
Mint an Entra clientcredentials token and call a B2C-protected API CVE-2026-50338 !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json from typing import Any, Optional from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
CVE-2026-33843: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
PT-2026-42841
Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authentication bypass exists via an alternate path or channel, which allows an unauthorized attacker to elevate privileges over a network. Recommendations At t...
Malware in kl-b2c-ui-kit
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious Package
Overview kl-b2c-ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-3082 Malicious code in kl-b2c-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...
Malicious code in kl-b2c-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...