God Mode Vulnerability Lets Attackers Access Any Resource in Microsoft Cloud Tenants

A recently disclosed flaw, tracked as CVE-2025-55241, allowed any attacker in possession of a single “Actor token” from a test or lab tenant to assume full administrative control over every Microsoft Entra ID (Azure AD) customer globally. Security researcher Dirk-Jan Mollema revealed that a critical validation error in Microsoft’s token-based service communication could have turned a low-privilege service token into a universal master key.

From multinational corporations to small startups, no tenant would have been safe. An attacker with such a token could read user profiles, group memberships, application permissions, BitLocker recovery keys, and more, without triggering any alarms or alerts, and could spin up new Global Admin accounts or hijack existing ones.

The vulnerability thus exposed a fundamental weakness in centralized authority models, highlighting the risk of absolute power in vendor-supplied identity providers and suggesting a need for distributed, authorityless security concepts.