The Siemens linux-entra-sso plugin for Linux enables single sign-on (SSO) on Microsoft Entra ID. Prior to version 1.8.1, the Chrome adapter registers a declarativeNetRequest rule with a URL filter matching any URL containing "https://login.microsoftonline.com/" as a substring. Because Chrome's urlFilter matches substrings without anchors, and the extension declares broad host permissions ("https://*/*"), navigation to attacker-controlled URLs embedding the login URL substring causes the plugin to attach the Entra ID Primary Refresh Token cookie to requests to those attacker-controlled hosts. The Firefox adapter performs a stricter check preventing this. This improper access control vulnerability allows unauthorized exposure of sensitive authentication tokens. The vulnerability is fixed in linux-entra-sso version 1.8.1.

An attacker controlling a URL that embeds the Microsoft Entra ID login URL substring can cause the vulnerable linux-entra-sso Chrome extension to attach the Primary Refresh Token cookie to requests sent to the attacker-controlled host. This could lead to unauthorized access to sensitive authentication tokens, potentially compromising user accounts. The CVSS score is 5.3 (medium severity), reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

This vulnerability is fixed in linux-entra-sso version 1.8.1. Users and administrators should upgrade to version 1.8.1 or later to remediate this issue. No other mitigation or workaround is indicated in the vendor advisory or available data.