Microsoft patch of widespread Entra ID authentication flaw disclosed

An authentication vulnerability in Microsoft Entra ID has been patched prior to being publicly revealed, and before criminals could use it to carry out attacks in the wild. And good thing, because the flaw could potentially have led to the compromise of every Entra ID tenant in the world, except for one critical class.

The severity of CVE-2025-55241 has been recognized in the Common Vulnerability Scoring System with a 9.0 subsequently raised to the maximum, 10. The “Azure Entra Elevation of Privilege Vulnerability” was discovered by red-team hacker Dirk-jan Mollema of Outsider Security, who said it could have been used to gain access to every enterprise digital ID on the platform “except probably those in national cloud deployments.”

Mollema found that Microsoft uses “undocumented impersonation tokens,” or “Actor tokens” for communication between back-end services. Since the legacy Azure AD Graph API did not properly validate the originating tenant, a token requested in any given tenant could perform authentication as any user, admins included, in any tenant.

“Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants,” Mollema explains in his post on the vulnerability.

He was unable to confirm that the vulnerability does not exist in national cloud deployments, but points out in his post that they use their own token signing keys, which should make the attack impossible to execute from a public cloud tenant.

The Azure AD Graph API was in midst of being sunset when the vulnerability was discovered. It reached the end of extended access on August 31, and has been replaced by Microsoft Graph for unified access to a broader range of services.

Microsoft enhanced the authentication policy controls for Entra earlier this year to allow administrators to mandate more frequent reauthentication.

Article Topics

biometric authentication  |  biometrics  |  Microsoft Entra  |  multifactor authentication