A terrifying Microsoft flaw could’ve allowed hackers to compromise ‘every Entra ID tenant in the world’
The Entra ID vulnerability could have allowed full access to virtually all Azure customer accounts
Microsoft has patched a flaw in Entra ID - previously known as Azure Active Directory - that could have given an attacker full access to virtually every single Entra ID tenant in the world.
The vulnerability, CVE-2025-55241, has been given the maximum CVSS score of 10.0, but doesn’t appear to have been exploited in the wild.
However, Dirk-jan Mollema, the security researcher who discovered the flaw, said it was “the most impactful Entra ID vulnerability that I will probably ever find”.
“This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments),” Mollema noted in a blog post detailing his discovery.
Notably, Mollema revealed there were two components to the vulnerability. The first centered on undocumented impersonation tokens, called 'Actor tokens', that Microsoft uses in its back-end for service-to-service (S2S) communication.
Secondly, a critical flaw in the Azure AD Graph API meant that it didn't properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
"Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants," Mollema wrote.
"Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that global admins can do, including taking over or creating new identities and granting them any permission in the tenant."
With these compromised identities, Mollema found access could’ve also been extended to Microsoft 365 and Azure.
How the Entra ID flaw worked
Starting with an Actor token, an attacker could find the tenant ID for the victim by using public APIs based on the domain name.
After finding a valid netId of a regular user in the tenant, perhaps through brute force, the attacker could create an impersonation token with the Actor token, using the tenant ID and netId of the user in the victim tenant.
Thereafter, an attacker could then list all global admins in the tenant and their netId, craft an impersonation token for the global admin account, and perform any read or write action over the Azure AD Graph API.
Mollema said that while the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens represents a weakness.
"If it weren’t for the complete lack of security measures in these tokens, I don’t think such a big impact with such limited telemetry would have been possible," he said.
Mollema immediately reported his findings to Microsoft, which fixed it within a few days. The tech giant has since rolled out further mitigation measures to block applications from requesting Actor tokens for the Azure AD Graph API.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
What is an ASIC?Understand the idea behind the the application-specific integrated circuit (ASIC) chip, and the role it plays across AI, automotive, crypto, and medicine
-
As global risks rise, businesses are looking to sovereignty for infrastructure controlIndustry Insights Escalating global uncertainty is pushing organisations to seek greater control through data sovereignty
-
'It delivers world-class performance at 50 percent of the cost of leading models': Microsoft unveils cut-price AI for security with latest in-house model launchNews Pairing the MAI security model with GPT-5.4 gives benchmark leading results at half the cost, according to the tech giant
-
Why Microsoft paused Patch Tuesday updates for some Dell devicesNews Select devices running Intel Innovation Platform Framework drivers encountered “poor performance”
-
Passkeys will soon be the default authentication method in Microsoft Entra ID – here's what it means for users and when the changes come into effectNews The shift to passkeys for Microsoft Entra ID comes amidst growing concerns over AI-powered phishing and identity theft
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Hackers are capitalizing on AI hype to ramp up social engineering attacks – and they're using big brands like Anthropic, OpenAI, and DeepSeek as ‘bait’ to lure victimsNews Microsoft says cyber criminals are impersonating popular AI platforms to deliver malware
-
Beware of emails threatening a code of conduct review
News A widespread phishing campaign has targeted tens of thousands of employees
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
