CVE-2025-66390 describes a vulnerability in Microsoft Azure API Management where, if self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by altering the hostname or tenant identifier to Tenant B, even if Tenant B has signup disabled in the UI. The root cause is that the underlying API endpoint still accepts cross-tenant requests based on the Host header, bypassing the UI restriction. The vendor evaluated the report and concluded that this behavior does not cross a security boundary and is a configuration or state issue rather than a product vulnerability affecting tenant isolation. The affected product is a cloud service, and a patch is available.

An attacker can bypass the UI-level signup disablement in one tenant by reusing the signup flow from another tenant where signup is enabled. This could lead to unauthorized registrations in tenants that intended to disable signup. However, the vendor states this does not violate tenant isolation or cross security boundaries, indicating limited impact on tenant data confidentiality or integrity. The CVSS score is 9.8, reflecting high potential impact if exploited, but the vendor's assessment suggests the issue is more about configuration management than a direct security boundary bypass.

Since this is a cloud-hosted service, Microsoft manages remediation server-side. A patch is available for this issue. Users should monitor the vendor advisory for patch deployment status and apply any recommended updates or configuration changes as provided by Microsoft. No additional mitigation steps are specified by the vendor, as the issue is considered a configuration/state problem rather than a direct vulnerability affecting tenant isolation.