Microsoft has patched a flaw in Entra ID - previously known as Azure Active Directory - that could have given an attacker full access to virtually every single Entra ID tenant in the world.
The vulnerability, CVE-2025-55241, has been given the maximum CVSS score of 10.0, but doesn’t appear to have been exploited in the wild.
However, Dirk-jan Mollema, the security researcher who discovered the flaw, said it was “the most impactful Entra ID vulnerability that I will probably ever find”.
“This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments),” Mollema noted in a blog post detailing his discovery.
Notably, Mollema revealed there were two components to the vulnerability. The first centered on undocumented impersonation tokens, called 'Actor tokens', that Microsoft uses in its back-end for service-to-service (S2S) communication.
Secondly, a critical flaw in the Azure AD Graph API meant that it didn't properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
"Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants," Mollema wrote.
"Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that global admins can do, including taking over or creating new identities and granting them any permission in the tenant."
With these compromised identities, Mollema found access could’ve also been extended to Microsoft 365 and Azure.
How the Entra ID flaw worked
Starting with an Actor token, an attacker could find the tenant ID for the victim by using public APIs based on the domain name.
After finding a valid netId of a regular user in the tenant, perhaps through brute force, the attacker could create an impersonation token with the Actor token, using the tenant ID and netId of the user in the victim tenant.
Thereafter, an attacker could then list all global admins in the tenant and their netId, craft an impersonation token for the global admin account, and perform any read or write action over the Azure AD Graph API.
Mollema said that while the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens represents a weakness.
"If it weren’t for the complete lack of security measures in these tokens, I don’t think such a big impact with such limited telemetry would have been possible," he said.
Mollema immediately reported his findings to Microsoft, which fixed it within a few days. The tech giant has since rolled out further mitigation measures to block applications from requesting Actor tokens for the Azure AD Graph API.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
Zoom CEO Eric Yuan thinks AI will pave the way for a three-day weekNews Yuan joins Nvidia CEO Jensen Huang and Bill Gates in touting the potential for AI to unlock reduced working hours
-
Everything we know about the Collins Aerospace disruption so farNews Passengers at a string of European airports faced severe disruption
-
‘Channel their curiosity into something meaningful’: Cyber expert warns an uptick of youth hackers should be a ‘wake-up call’ after teens charged over TfL attackNews Encouraging youths to engage in positive tech initiatives will guide them down the right path and away from nefarious activities
-
Microsoft and Cloudflare just took down a major phishing operationNews RaccoonO365’s phishing as a service platform has risen to prominence via Telegram
-
Cyber professionals are losing sleep over late night attacksNews Hackers are biding their time and launching attacks when businesses can’t respond
-
BreachForums founder resentenced to three years in prisonNews A US appeals court vacated his previous sentence and remanded the case for resentencing
-
Jaguar Land Rover says IT disruption set to continueNews The automotive manufacturer is still not fully operational after the recent cyber attack
-
Nearly 700,000 customers impacted after insider attack at US fintech firmNews FinWise, which provides loans on behalf of US financial services firms, revealed a former employee accessed sensitive customer information after leaving the firm.
-
How to check if you’ve been affected by Salesforce attacks – and stop hackers dead in their tracksNews The FBI has issued a fresh advisory over the threat posed to Salesforce customers by two threat groups. Here's how you can stay safe and mitigate any risks.
-
Kids hacking for kicks are causing security headaches at schoolsNews More than half of cyber incidents at schools are caused by students, with some tech-savvy pupils attempting to bypass security and network controls.
