Critical Azure Entra ID Flaw Highlights Microsoft IAM Issues

A critical Microsoft authentication vulnerability in Entra ID could have enabled cross‑tenant compromises, according to researcher Dirk-jan Mollema, who disclosed the flaw after finding an authentication failure in the Azure AD Graph API. The elevation of privilege vulnerability, tracked as CVE-2025-55241, was fixed over the summer and disclosed earlier in September 2025; initial CVSS was 9.0 and was later raised to 10.0, though there is no evidence it was exploited in the wild.

Mollema described how, using a token issued in one lab tenant, an attacker could authenticate as any user, including global admins, in other tenants via Actor tokens—undocumented tokens that bypass access controls and are not subject to policy, logs or standard auditing. Microsoft said it mitigated the issue quickly as part of its Secure Future Initiative, issued a no-action CVE-2025-55241, and stressed it did not observe abuse of the vulnerability.

The disclosure has renewed criticism of Microsoft’s Azure IAM posture, and the CSRB’s 2024 report cited weak security around Azure’s identity stack and the need for stronger logging and impersonation protections, with Storm‑0558 named as a threat actor in the broader context.