CVE-2025-55241: Microsoft Entra ID Flaw with CVSS 10.0 Could Have Compromised Every Tenant Worldwide

CVE-2025-55241, tracked with a CVSS score of 10.0, was disclosed by security researcher Dirk-jan Mollema as a flaw in Microsoft Entra ID (formerly Azure AD) that could have allowed attackers to compromise virtually every tenant worldwide. The vulnerability stemmed from undocumented impersonation tokens, known as Actor tokens, and a validation flaw in the legacy Azure AD Graph API that failed to enforce tenant boundaries.

Mollema described the potential impact as enabling access to data in other tenants and even impersonation of Global Admins, with attackers able to escalate to full tenant takeover while leaving few traces. The flaw involved two key issues: Actor tokens bypassed Conditional Access and had no logging or revocation before expiry, and the Graph API did not validate tenant IDs in impersonation tokens.

According to Microsoft’s Security Response Center (MSRC), Microsoft acted quickly, patching the vulnerability within days, and blocking Actor tokens from being requested for Azure AD Graph, while issuing CVE-2025-55241.