Threats Tagged 'cve-2025-66390'

Microsoft Azure API Management has a configuration issue in the self-service signup API endpoint that allows cross-tenant requests even when signup is disabled for some tenants in the UI. This vulnerability enables an attacker to reuse the registration flow by altering the hostname or tenant identifier to target tenants with signup disabled. The vendor clarifies that this is a configuration/state issue that does not violate tenant isolation or cross security boundaries. The vulnerability has a high CVSS score of 9.8 and affects the cloud service up to 2025-10-17.

Microsoft Azure API Management through 2025-10-17 has a vulnerability where self-service signup enabled in one tenant can be reused by an attacker to register in another tenant that has signup disabled at the UI level. This occurs because the underlying API endpoint accepts cross-tenant requests based on the Host header, ignoring the UI setting. The vendor states this is a configuration/state issue and does not cross a security boundary or affect tenant isolation. The service is cloud-hosted, and a patch is available.