Critical Microsoft Entra ID Vulnerability Exposes Global Tenants to Complete Compromise
6 sources · Updated 4mo ago · First seen Sep 19, 2025
Security researcher Dirk-Jan Mollema disclosed CVE-2025-55241, a flaw in Microsoft Entra ID (Azure AD) that allowed a single token to grant administrative access to every tenant worldwide. The vulnerability stemmed from improper validation of 'Actor tokens,' enabling attackers to bypass all security controls and remain undetected. This incident highlights the systemic risk of centralized authority in identity platforms and calls for distributed, authorityless security architectures.
Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.
Check your exposure
