Skip to content

CVE-2026-42901 — Microsoft Entra ID

Key facts

CVE-2026-42901 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Entra ID. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.
CVE CVE-2026-42901
Severity Critical (10.0)
Vendor Microsoft
Product Microsoft Entra ID
Detection / prevention Snort
PoC poc.py
Source 2026/CVE-2026-42901/

Details

CVE-2026-42901 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Entra ID. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview

Field Value
CVE CVE-2026-42901
CVSS 10.0 (Critical)
Vendor Microsoft
Product Microsoft Entra ID
Affected All tenants using OAuth 2.0 / OIDC token endpoints
Fixed Apply Microsoft security patch (see References)

Root Cause

Microsoft Entra ID's OAuth 2.0 token endpoint performs insufficient validation of the Origin header and redirect_uri parameter during authorization code exchange. The endpoint fails to strictly match the registered redirect URI against the supplied value, allowing wildcard or partial matches to succeed. Additionally, cross-origin requests are accepted without enforcing CORS restrictions on the token endpoint, enabling an attacker-controlled origin to participate in the OAuth flow undetected.

Problem

An unauthenticated remote attacker can exploit this origin validation error to perform unauthorized privilege escalation over the network:

  • Token hijacking: Craft a malicious redirect URI that satisfies Entra ID's weak validation, intercepting authorization codes or access tokens issued to legitimate users.
  • Privilege escalation: Obtain tokens scoped to high-privilege roles (e.g., Global Administrator) without possessing those privileges.
  • Cross-tenant abuse: In multi-tenant configurations, leverage intercepted tokens to access resources across organizational boundaries.
  • Session takeover: Use captured tokens to impersonate victims in downstream services that trust Entra ID-issued JWTs.

No user interaction beyond visiting a malicious page is required in certain attack scenarios.

Detection

Run the included proof-of-concept to test whether your Entra ID tenant is vulnerable:

python poc.py --target <tenant-id> --client-id <app-client-id> --redirect-uri <registered-uri>

The PoC attempts an authorization code exchange using a manipulated redirect_uri and a crafted Origin header. A vulnerable endpoint returns a valid token response (200 OK) instead of invalid_grant or redirect_uri_mismatch.

Signs of exploitation in logs: - Entra ID Sign-in logs: token issuances to unexpected redirect URIs - Conditional Access logs: policy bypasses from unknown origins - Audit logs: role assignment changes shortly after anomalous token issuances

Remediation

  1. Apply Microsoft patch: Install the security update issued by Microsoft for Entra ID. Cloud-managed tenants receive this automatically; sovereign cloud and hybrid deployments may require manual action.
  2. Enforce strict redirect URI matching: In App Registrations → Authentication, remove any wildcard (*) or overly broad redirect URIs. Use exact, fully qualified URIs only.
  3. Enable Conditional Access: Create policies that enforce MFA, trusted locations, and compliant device requirements for all privileged roles.
  4. Restrict token endpoint CORS: Review App Proxy and custom domain configurations to prevent unauthorized origins from reaching token endpoints.
  5. Audit existing app registrations: Review all registered applications for loose redirect URI patterns using Microsoft Entra admin center or az ad app list.
  6. Enable Identity Protection: Turn on risk-based Conditional Access policies to detect and block anomalous token usage in real time.

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42901
  • Microsoft Security Response Center: https://msrc.microsoft.com
  • OAuth 2.0 Security Best Practices (RFC 9700): https://datatracker.ietf.org/doc/html/rfc9700

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-42901, for authorized testing and blue-team detection engineering:

References: NVD — CVE-2026-42901 · full write-up on the searchable site

Detection & prevention rules

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"CVE-2026-42901 Entra ID OAuth malformed redirect_uri bypass"; flow:to_server,established; content:"/oauth2/v2.0/token"; http_uri; content:"redirect_uri"; http_client_body; pcre:"/redirect_uri=[^&]*(%00|%0d|%0a|%09|%20%20)/i"; classtype:web-application-attack; sid:9002691; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"CVE-2026-42901 Entra ID OAuth spoofed Origin header on token endpoint"; flow:to_server,established; content:"/oauth2/"; http_uri; content:"Origin:"; http_header; content:"grant_type"; http_client_body; pcre:"/Origin:\s*https?:\/\/(?!login\.microsoftonline\.com)[^\r\n]+/i"; classtype:web-application-attack; sid:9002692; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"CVE-2026-42901 Entra ID redirect_uri domain confusion attempt"; flow:to_server,established; content:"/authorize"; http_uri; content:"redirect_uri"; http_uri; pcre:"/redirect_uri=https?(%3A%2F%2F|:\/\/)(?!.*\.microsoft\.com|.*\.microsoftonline\.com)[^& ]{4,}/i"; classtype:web-application-attack; sid:9002693; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-42901?

CVE-2026-42901 (Microsoft) is a Critical (10.0) vulnerability: Microsoft Entra ID. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-42901?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-42901?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Other entries for the same vendor or product:

For authorized security testing and research only. See the full source and NVD record.