Two Azure Entra ID Sign-In Log Bypasses Discovered and Fixed: Tokens Retrievable Without Logging
By
nyxgeek
2mo ago· 27 min readenInsight
100/100
Golden Brown
Bagelometer↗
Pure flour-power. Hearty enough to carry you through lunch.
Score100TypeanalysisSentimentnegative
Summary
A security researcher (Nyxgeek) discloses two newly discovered Azure Entra ID sign-in log bypass vulnerabilities that were recently fixed. By sending specially crafted login attempts to Azure authentication endpoints, attackers could retrieve valid authentication tokens without any activity appearing in Entra ID sign-in logs, effectively making intrusions invisible to administrators who rely on these logs for detection.
Key quotes
· 3 pulledBy sending a specially crafted login attempt to the Azure authentication endpoint, it was possible to retrieve valid tokens without the activity appearing in the Entra ID sign-in logs.
This is critical logging…logging that administrators across the world rely on to detect intrusions…logging that could be made optional.
Invisible password sprays. Invisible logins. Full tokens returned.
Invisible password sprays. Invisible logins. Full tokens returned.
