CVE-2026-83711: CWE-639: Authorization Bypass Through User-Controlled Key in Microsoft Entra

This vulnerability, tracked as CVE-2026-83711 and categorized under CWE-639 (Authorization Bypass Through User-Controlled Key), affects Microsoft Entra, specifically Azure Active Directory B2C. It allows an attacker without privileges to bypass authorization controls by manipulating a user-controlled key, resulting in privilege escalation over the network. The vulnerability is critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and complete confidentiality and integrity impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An attacker can remotely bypass authorization controls and elevate privileges within Microsoft Entra (Azure AD B2C), potentially gaining unauthorized access to sensitive resources or administrative functions. The impact includes full confidentiality and integrity compromise but no availability impact. This could lead to significant security breaches if exploited.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Administrators should verify that their Azure AD B2C environments have been updated according to Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83711. No additional mitigation actions are required beyond applying the official fix.