All Microsoft Entra Tenants Were Exposed to Silent Compromise via Invisible Actor Tokens: Researcher

All Microsoft Entra Tenants were exposed to silent compromise due to undocumented Actor tokens used in backend service-to-service communications, combined with a validation flaw in Azure AD Graph API, according to Microsoft Security Response Center (MSRC). The researcher Dirk-jan Mollema described how attackers could request an Actor token within their own tenant to authenticate as any user, including Global Admins, in any other tenant, with the token usable for 24 hours.

He noted that the tokens were not subject to security policies and that there was no logging of their issuance or use in the Graph API, meaning an invisible attacker could access Entra ID data across tenants. MSRC addressed the issue by issuing CVE-2025-55241 on 4 September 2025, stating the vulnerability required no customer action to resolve, and mitigations were pushed by 6 August 2025 to prevent Actor tokens from being issued for the Azure AD Graph with SP credentials.

The article states that, to date, there is no evidence that the vulnerability has been used by any attacker, highlighting the ongoing need for vigilance as cybersecurity risks evolve beyond traditional tools.