Auth bypass in Azuread Microsoft-Authentication-Library-For-Dotnet
CVE-2024-27086
The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.
Vulnerability class: Broken Access Control
EPSS: 0.002 (8.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L.
Affected products
- Azuread Microsoft-authentication-library-for-dotnet — versions >= 4.48.0, < 4.59.1, >= 4.60.0, < 4.60.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-27086?
- CVE-2024-27086 is a low-severity vulnerability in Azuread Microsoft-Authentication-Library-For-Dotnet, classified under Incorrect Authorization. CVSS score: 3.9/10. Published 2024-04-16.
- How severe is CVE-2024-27086?
- Low severity. CVSS v3 base score is 3.9 out of 10.