Skip to content

Authentication Bypass in passport-azure-ad

High severity GitHub Reviewed Published Jul 26, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm passport-azure-ad (npm)

Affected versions

>= 1.0.0, < 1.4.6
= 2.0.0

Patched versions

1.4.6
2.0.1

Description

Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

Recommendation

Version 1.x: Update to version 1.4.6 or later.
Version 2.x: Update to version 2.0.1 or later.

References

Published to the GitHub Advisory Database Jul 26, 2018
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

High
8.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CVE ID

CVE-2016-7191

GHSA ID

GHSA-73jp-3c67-hjfv

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.