56 matches found
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service allows attackers to bypass authentication by using a user-controlled key, enabling them to escalate their privileges.
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to the bypassing of authentication processes by using a user-controlled key. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50338
CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...
EUVD-2026-70795
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-83711
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711
Microsoft Azure Active Directory B2C is affected by an authorization bypass vulnerability caused by a user-controlled key, enabling an unauthorized attacker to elevate privileges over the network. The vulnerability is rated CVSS 3.1 10.0 (Critical) with no privileges required , no user interactio...
PT-2026-85314
Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authorization bypass exists in cloud identity deployments supporting public-facing authentication flows. This issue occurs due to a user-controlled key, which...
PT-2026-42841
Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authentication bypass exists via an alternate path or channel, which allows an unauthorized attacker to elevate privileges over a network. Recommendations At t...
Malicious Package
Overview kl-b2c-ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in kl-b2c-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...
MAL-2026-3082 Malicious code in kl-b2c-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e32dd1450d1b5670388a4fbf71a7189cff326aa1c7734ee6ea1c89614438c516 The package kl-b2c-ui-kit was found to contain malicious code. Source: ghsa-malware c42673f7cabe65ad288149a7f75426fea7054327c8f73ac59d07e6b60a64b3db...
EUVD-2024-19093
Malicious code in bioql PyPI...
CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...
Chameleon Android Banking Trojan Targets Users Through Fake CRM App
Cybersecurity researchers have lifted the lid on a new technique adopted by threat actors behind the Chameleon Android banking trojan targeting users in Canada by masquerading as a Customer Relationship Management CRM app. "Chameleon was seen masquerading as a CRM app, targeting a Canadian...
CVE-2024-40425
File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...
CVE-2024-40425
File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...