| ▲ | unddoch 8 hours ago | |||||||||||||||||||||||||||||||
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent? The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists. | ||||||||||||||||||||||||||||||||
| ▲ | publlus_enigma 3 minutes ago | parent | next [-] | |||||||||||||||||||||||||||||||
I'm sure one of the 60,000 employees who have been told they're welcome not to work there anymore, because the line must go up infinitely, will be chomping at the bit to do so. | ||||||||||||||||||||||||||||||||
| ▲ | birdsongs 6 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a different middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket after three months. | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||
| ▲ | wibartle 10 minutes ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
That's me. But I don't understand your comment. Could you expand on it, either in a reply or preferably by email or via an MSRC case? You can reply with the vuln number so I can fast route it. > The callback you're redirecting the user to at the end of that flow is forgeable The redirect_uri is checked against the app registration. There's a general OAuth problem called "open registration redirects" that applies here, about which we've [blogged](https://www.microsoft.com/en-us/security/blog/2026/03/02/oau...) - but frankly, none of the industry solves this well. In general, "I can create a link that goes to malware via X endpoint" isn't very interesting - you can also just create a direct link to the malware. Web browsers won't reliably show you the real destination of a link anyhow and even if they did, it's mostly just us hackers who understand URLs at all. > as long as a way to authenticate users exists. I'm lost. Entra supports [OpenID Connect](https://learn.microsoft.com/en-us/entra/identity-platform/v2...) for authentication. Most portals that surface admin consent authenticate the user with an OpenID Connect request either immediately before or after the admin consent request. | ||||||||||||||||||||||||||||||||
| ▲ | nikanj 2 hours ago | parent | prev [-] | |||||||||||||||||||||||||||||||
I love that this is the most reliable way to actually contact an actual human working at Microsoft | ||||||||||||||||||||||||||||||||