CVE-2026-45108 is an incorrect authorization vulnerability (CWE-863) in the himmelblau interoperability suite for Microsoft Azure Entra ID and Intune. The flaw exists in the token_validate function used during the Device Authorization Grant flow, where domain aliases are validated but the local part of the username in the UPN is not checked for a match. This allows an attacker authenticated within the same Entra ID domain to impersonate another user locally by providing their own valid credentials. The vulnerability affects himmelblau versions >= 2.0.0 and < 2.3.11, and >= 3.0.0-alpha and < 3.1.5. It is fixed in versions 2.3.11 and 3.1.5. The CVSS 3.1 base score is 8.4, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impact.

An attacker with valid credentials in the same Microsoft Azure Entra ID domain can bypass proper authorization checks to obtain a local Unix session as another user. This leads to a complete compromise of confidentiality and integrity for the targeted user account, with limited impact on availability. The vulnerability affects cloud-hosted himmelblau services, potentially allowing lateral movement or privilege escalation within the domain environment.

The vulnerability is fixed in himmelblau versions 2.3.11 and 3.1.5. Since himmelblau is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor that their environment is running a patched version or that the vendor has applied the fix. Patch status is confirmed as available. No additional mitigation actions are specified or required beyond applying the official fix.