CVE-2026-80092

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

EUVD-2026-102953

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

CVE-2026-80092

The Microsoft Identity Web component is affected by an authentication bypass vulnerability caused by assumed-immutable data . This flaw allows an authorized attacker to achieve privilege elevation over a network. The vulnerability is associated with CWE-302 . No specific exploit details or remedi...

PT-2026-115978

Name of the Vulnerable Software and Affected Versions Microsoft Identity Web affected versions not specified Description An authentication bypass exists due to the use of assumed-immutable data, which allows an authorized attacker to elevate privileges over a network. Recommendations At the momen...

CVE-2026-80092: Authentication Bypass by Assumed-Immutable Data

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

Microsoft Identity Web Authorization Vulnerability

The Microsoft Identity Web component has an authorization issue. This vulnerability stems from the use of assumed-immutable data, which allows authentication bypasses. It may enable authorized attackers to escalate their privileges through the network...

Microsoft Identity Web Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...

KLA91354 Multiple vulnerabilities in Microsoft Identity Client

Multiple vulnerabilities were found in Microsoft Identity Client. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

Malicious code in identity-web (npm)

--- Credit: OpenSSF source...

EUVD-2025-10551

Malicious code in bioql PyPI...

Microsoft Identity Abstractions Unauthorized Access

The vulnerability of the Microsoft.Identity.Abstractions component in the Microsoft Identity Web library is related to the disclosure of information through registration files. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected information...

CVE-2025-32016

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Impact What kind of vulnerability is it? Who is impacted? Description: This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the...

CVE-2025-32016

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016

This CVE affects Microsoft Identity Web (and related Microsoft.Identity.Abstractions) used with ASP.NET Core for Azure AD v2.0 / AAD B2C integrations. Under certain conditions, service logs can expose sensitive credentials, including local file paths with passwords, Base64-encoded values, and Cli...

CVE-2025-32016: Insertion of Sensitive Information into Log File

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...