The linux-entra-sso plugin for Linux enables single sign-on (SSO) on Microsoft Entra ID. Before version 1.8.1, the Chrome adapter registers a declarativeNetRequest rule with a urlFilter that substring-matches URLs containing "https://login.microsoftonline.com/". Because Chrome's urlFilter matches substrings without strict anchoring, and the extension has broad host permissions ("https://*/*"), an attacker can craft a URL embedding the legitimate login URL in its path. This causes the plugin to attach the Primary Refresh Token cookie to requests sent to attacker-controlled domains, leaking sensitive authentication tokens. The Firefox adapter performs a stricter check and is not vulnerable. The vulnerability is addressed in linux-entra-sso version 1.8.1.

An attacker controlling a malicious website can trick the vulnerable linux-entra-sso Chrome extension into sending the Entra ID Primary Refresh Token cookie to attacker-controlled domains. This token leakage can lead to unauthorized access to the user's Microsoft Entra ID session. The CVSS score is 5.3 (medium severity), reflecting network attack vector, high impact on confidentiality, but requiring user interaction and high attack complexity.

This vulnerability is fixed in linux-entra-sso version 1.8.1. Users and administrators should upgrade to version 1.8.1 or later to remediate this issue. No official patch or workaround information beyond upgrading is provided. Until upgrading, avoid granting broad host permissions to the extension or using it in untrusted browsing contexts.