Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. (CVE-2026-80092)

This vulnerability involves an authentication bypass in Microsoft Identity Web due to reliance on data assumed to be immutable. An attacker who is already authorized but with limited privileges can exploit this flaw to elevate their privileges within the network environment. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or remediation details are available in the provided data.

An authorized attacker with limited privileges can bypass authentication controls to gain elevated privileges, potentially leading to unauthorized access to sensitive information. The confidentiality impact is high, but integrity and availability are not affected. This could allow attackers to access data or functionality beyond their intended permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided. Organizations should monitor vendor communications for updates and apply patches once available.