Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
What privileges could an attacker gain by exploiting this vulnerability? An attacker could obtain another user's access token and access resources permitted by that token. The accessible resources depend on the permissions granted to the affected user's token. What conditions are required to exploit this vulnerability? Successful exploitation requires the application to use a shared token cache and the targeted user to have an active token in that cache.
David Morrison with University of Edinburgh, Tahira Muhammad with Student @ College of Southern Nevada, <a href="https://www.linkedin.com/company/vantage-security-corporation/">Vantage Sec</a>, Jeff Smith with Independent Researcher, Tamim Abu Aiash