Unveiling the Microsoft Entra ID Vulnerability: How Hackers Could Hijack Any Company’s Tenant

Recently, a significant vulnerability in Microsoft’s Entra ID raised alarms. This flaw could have let attackers access any company’s Entra ID tenant worldwide. The issue arose from a combination of undocumented “actor tokens” and a weakness in the Azure AD Graph API, designated as CVE-2025-55241.

Threat actors could exploit this vulnerability to access sensitive data without leaving evidence in the logs, except for their own actions. Entra ID, previously known as Azure Active Directory, manages access for apps used within organizations, including popular services like Microsoft 365 and Salesforce.

Security researcher Dirk-jan Mollema discovered that he could gain Global Admin privileges across all Entra ID tenants due to a flaw in how actor tokens worked. These tokens are meant to authenticate user actions across various services, but in this case, they allowed impersonation of any user without proper checks.

Mollema explained that actor tokens lack essential security features. They aren’t signed, which means an attacker could use them to impersonate any user for up to 24 hours without being revoked. This opened the door for significant security breaches.

They bypass conditions often set to limit access. For example, a company might have rules to prevent unauthorized logins, but an actor token could easily slip through those restrictions. Mollema criticized the design of these tokens, emphasizing that they should not allow such sweeping access.

To illustrate, in tests, Mollema noticed that even when he targeted a different tenant using an actor token, the system still accepted it, revealing a significant flaw. He could view data from another tenant as long as he knew the tenant ID and a valid user ID from that organization.

He outlined a simple method for potential attackers to exploit this vulnerability:

• Identify the targeted tenant ID, which is often public information.
• Obtain a valid user ID from the target tenant.
• Create an impersonation token using the actor token and the tenant ID.
• Access the Azure AD Graph API to perform actions as a Global Admin.

None of these steps would create logs in the victim’s tenant, making detection extremely difficult.

Interestingly, Microsoft has been moving away from the Azure AD Graph API since last September. As part of its security enhancements, the company aimed to phase out the reliance on such high-privileged access methods.

Mollema reported the vulnerability to Microsoft on July 14, and it was patched just nine days later. On September 4, Microsoft labeled the flaw as critical and took steps to resolve it.

This incident reminds us of the importance of robust security systems and constant vigilance. With 46% of environments experiencing cracked passwords—up from 25% the previous year—it’s clear that organizations need to take their security seriously. Enhancing measures to protect sensitive data is more crucial than ever.

Learning about vulnerabilities like those found in Entra ID helps organizations bolster their defenses against potential attacks. For more insights on security trends, you can refer to industry reports, such as the Picus Blue Report 2025.

Source link