The azureauthextension in opentelemetry-collector-contrib (versions 0.124.0 to 0.150.0) contains a server-side authentication bypass vulnerability. It fails to properly validate incoming bearer tokens as JWTs, instead comparing the token string directly to a token obtained from its configured credential. The scope for the token request is taken from the client-supplied Host header, allowing tokens minted for any Azure resource accessible by the service principal to authenticate if the attacker matches the Host header. This enables token replay attacks within the token's valid lifetime. The vulnerability impacts authentication integrity and availability of OpenTelemetry receivers using azure_auth.

An attacker with any valid Azure access token for any scope the collector's configured identity can mint can bypass authentication to OpenTelemetry receivers using azure_auth. This compromises authentication integrity and availability, potentially allowing unauthorized access and disruption of telemetry data collection. Tokens can be replayed for their full issued lifetime, increasing the attack window. No direct confidentiality impact is indicated. The vulnerability affects cloud-hosted services.

A patch is available for this vulnerability. Since the affected product is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that their service version is updated beyond 0.150.0 or that the patch has been applied. Until then, avoid relying on vulnerable versions. No additional mitigation steps are specified in the provided data.