A terrifying Microsoft flaw could’ve allowed hackers to compromise ‘every Entra ID tenant in the world’
The Entra ID vulnerability could have allowed full access to virtually all Azure customer accounts
Microsoft has patched a flaw in Entra ID - previously known as Azure Active Directory - that could have given an attacker full access to virtually every single Entra ID tenant in the world.
The vulnerability, CVE-2025-55241, has been given the maximum CVSS score of 10.0, but doesn’t appear to have been exploited in the wild.
However, Dirk-jan Mollema, the security researcher who discovered the flaw, said it was “the most impactful Entra ID vulnerability that I will probably ever find”.
“This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments),” Mollema noted in a blog post detailing his discovery.
Notably, Mollema revealed there were two components to the vulnerability. The first centered on undocumented impersonation tokens, called 'Actor tokens', that Microsoft uses in its back-end for service-to-service (S2S) communication.
Secondly, a critical flaw in the Azure AD Graph API meant that it didn't properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
"Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants," Mollema wrote.
"Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that global admins can do, including taking over or creating new identities and granting them any permission in the tenant."
With these compromised identities, Mollema found access could’ve also been extended to Microsoft 365 and Azure.
How the Entra ID flaw worked
Starting with an Actor token, an attacker could find the tenant ID for the victim by using public APIs based on the domain name.
After finding a valid netId of a regular user in the tenant, perhaps through brute force, the attacker could create an impersonation token with the Actor token, using the tenant ID and netId of the user in the victim tenant.
Thereafter, an attacker could then list all global admins in the tenant and their netId, craft an impersonation token for the global admin account, and perform any read or write action over the Azure AD Graph API.
Mollema said that while the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens represents a weakness.
"If it weren’t for the complete lack of security measures in these tokens, I don’t think such a big impact with such limited telemetry would have been possible," he said.
Mollema immediately reported his findings to Microsoft, which fixed it within a few days. The tech giant has since rolled out further mitigation measures to block applications from requesting Actor tokens for the Azure AD Graph API.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
95% of organizations don’t fully trust their cybersecurity vendors – here’s whyNews Organizations are struggling to assess vendor credibility as trust becomes a key factor in risk management.
-
Meta engineer trusted advice from an AI agent, ended up exposing user dataNews The internal security incident exposed sensitive user data to unauthorized employees
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
