A terrifying Microsoft flaw could’ve allowed hackers to compromise ‘every Entra ID tenant in the world’
The Entra ID vulnerability could have allowed full access to virtually all Azure customer accounts
Microsoft has patched a flaw in Entra ID - previously known as Azure Active Directory - that could have given an attacker full access to virtually every single Entra ID tenant in the world.
The vulnerability, CVE-2025-55241, has been given the maximum CVSS score of 10.0, but doesn’t appear to have been exploited in the wild.
However, Dirk-jan Mollema, the security researcher who discovered the flaw, said it was “the most impactful Entra ID vulnerability that I will probably ever find”.
“This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments),” Mollema noted in a blog post detailing his discovery.
Notably, Mollema revealed there were two components to the vulnerability. The first centered on undocumented impersonation tokens, called 'Actor tokens', that Microsoft uses in its back-end for service-to-service (S2S) communication.
Secondly, a critical flaw in the Azure AD Graph API meant that it didn't properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
"Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants," Mollema wrote.
"Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that global admins can do, including taking over or creating new identities and granting them any permission in the tenant."
With these compromised identities, Mollema found access could’ve also been extended to Microsoft 365 and Azure.
How the Entra ID flaw worked
Starting with an Actor token, an attacker could find the tenant ID for the victim by using public APIs based on the domain name.
After finding a valid netId of a regular user in the tenant, perhaps through brute force, the attacker could create an impersonation token with the Actor token, using the tenant ID and netId of the user in the victim tenant.
Thereafter, an attacker could then list all global admins in the tenant and their netId, craft an impersonation token for the global admin account, and perform any read or write action over the Azure AD Graph API.
Mollema said that while the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens represents a weakness.
"If it weren’t for the complete lack of security measures in these tokens, I don’t think such a big impact with such limited telemetry would have been possible," he said.
Mollema immediately reported his findings to Microsoft, which fixed it within a few days. The tech giant has since rolled out further mitigation measures to block applications from requesting Actor tokens for the Azure AD Graph API.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
Stop treating agentic AI projects like traditional softwareAnalysis Designing and building agents is one thing, but testing and governance is crucial to success
-
PayPal appoints HP’s Enrique Lores in surprise CEO shake-upNews The veteran tech executive will lead the payments giant into its next growth phase amid mounting industry challenges
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
Thousands of Microsoft Teams users are being targeted in a new phishing campaignNews Microsoft Teams users should be on the alert, according to researchers at Check Point
-
Microsoft warns of rising AitM phishing attacks on energy sectorNews The campaign abused SharePoint file sharing services to deliver phishing payloads and altered inbox rules to maintain persistence
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
-
LastPass issues alert as customers targeted in new phishing campaignNews LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign that encourages users to backup vaults.
-
NCSC names and shames pro-Russia hacktivist group amid escalating DDoS attacks on UK public servicesNews Russia-linked hacktivists are increasingly trying to cause chaos for UK organizations
