Protocol · 1 briefs
Cloud identity CVEs
A single undocumented token design can become a cross-tenant Global Admin with no MFA, no Conditional Access, and no useful log. "No customer action" is a detection gap, not closed risk.
How this protocol fails
CVE-2025-55241 (Entra ID Actor tokens) is the defining cloud-identity flaw of the period: impersonate any user in any tenant, including Global Admin. Microsoft mitigated server-side and reported no evidence of abuse, with limited historical telemetry. The lesson is architectural. Legacy APIs (Azure AD Graph), undocumented first-party tokens, and missing tenant-boundary logs are how cloud identity fails without a Tuesday patch for you to install.
What security people should do
- Retire Azure AD Graph. Inventory high-privilege app registrations and service principals.
- Hunt for Global Admin or application-permission grants that have no matching interactive sign-in.
- Demand tenant-boundary telemetry from the cloud IdP. If the call produces no log, you cannot detect the next Actor-token equivalent.
- Bind privileged roles to phishing-resistant MFA and Conditional Access even when a backend path claims to skip them.
CVEs in this category
1
Cloud identity
0
On CISA KEV
0
Actively exploited
1
Showing
Severity
Year
Status
Showing 1 of 1
Working this protocol in production and see a brief we should add or correct? Email [email protected] or volunteer as a CVE Analyst.