CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...

Spring Cloud Azure Privilege Escalation

The vulnerability of the integrated connection platform for cloud services in Spring Cloud Azure is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to enhance their privileges remotely...

Improper Authentication

Spring Cloud Azure is vulnerable to improper authentication. The vulnerability is due to insufficient authentication controls, which allows an unauthorized attacker to elevate privileges over a network...

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...

com.azure.spring:spring-cloud-azure-actuator-autoconfigure (>=6.0.0-beta.1, <=6.4.0), com.azure.spring:spring-cloud-azure-appconfiguration-config (>=6.0.0, <=6.4.0) +33 more potentially affected by CVE-2026-69854 via com.azure.spring:spring-cloud-azure-autoconfigure (>=6.0.0-beta.1, <=6.4.0)

com.azure.spring:spring-cloud-azure-autoconfigure MAVEN version =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0, =6.0.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.2, =6.0.0-beta.1, =6.0.0-beta.2, =6.0.0, =6.0.0-beta.2, =6.0.0, =6.0.0, =6.0.0, =6.0.0-beta.2, =6.4.0 -...

CVE-2026-69854

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73791

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

com.azure.spring:spring-cloud-azure-actuator-autoconfigure (>=4.0.0-beta.2, <=7.3.0), com.azure.spring:spring-cloud-azure-appconfiguration-config (>=4.0.0-beta.1, <=7.3.0) +47 more potentially affected by CVE-2026-69854 via com.azure.spring:spring-cloud-azure-autoconfigure (>=4.0.0-beta.2, <=7.3.0)

com.azure.spring:spring-cloud-azure-autoconfigure MAVEN version =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.1, =4.0.0-beta.2, =4.0.0-beta.2, =5.13.0, =4.9.0, =4.0.0-beta.2, =7.3.0 -...

CVE-2026-69854

CVE-2026-69854 is an improper authentication vulnerability in Spring Cloud Azure that allows an unauthorized attacker to elevate privileges over a network . The CNA (Microsoft) assigned a CVSS 3.1 score of 9.0 (CRITICAL) with a changed scope , reflecting high impact on confidentiality, integrity,...

Spring Cloud Azure Elevation of Privilege Vulnerability

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854: Improper Authentication

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87760

Name of the Vulnerable Software and Affected Versions Spring Cloud Azure affected versions not specified Description Improper authentication allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...

Spring Cloud Azure B2C Cross-Issuer Auth Bypass (CVE-2026-50338)

Mint an Entra clientcredentials token and call a B2C-protected API CVE-2026-50338 !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json from typing import Any, Optional from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Exploit for CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-I...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ai.kitsy:cnos-java-azure (>=1.11.4, <=1.12.0), ai.kitsy:cnos-kotlin-azure (>=1.12.0, <=1.17.0) +178 more potentially affected by CVE-2024-35255 via com.microsoft.azure:msal4j (1.15.0)

com.microsoft.azure:msal4j MAVEN version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:msal4j and may be impacted: - ai.kitsy:cnos-java-azure =1.11.4, =1.12.0, =1.12.0, =1.12.0, =1.12.0, =1.12.0, =1.12.0, =1.12.0, =1.12.0,...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...