Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Priority LOW 28CWE-362Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from Microsoft.
Summary
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0083 57th percentileScored 2026-11-07
Fix Partial Azure Identity Library (Microsoft): 1.6.0Azure Identity Library for .NET (Microsoft): 1.11.4+13 more productsRed Hat: 2 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Azure Identity Library | 1.0.0 to before 1.6.0 | 1.6.0 | Patch available | CNA |
| Microsoft | Azure Identity Library for .NET | 1.0.0 to before 1.11.4 | 1.11.4 | Patch available | CNA |
| Microsoft | Azure Identity Library for C++ | 1.0.0 to before 1.8.0 | 1.8.0 | Patch available | CNA |
| Microsoft | Azure Identity Library for Java | 1.0.0 to before 1.12.2 | 1.12.2 | Patch available | CNA |
| Microsoft | Azure Identity Library for JavaScript | 1.0.0 to before 4.2.1 | 4.2.1 | Patch available | CNA |
| Microsoft | Azure Identity Library for Python | 1.0.0 to before 1.16.1 | 1.16.1 | Patch available | CNA |
| Microsoft | Microsoft Authentication Library | 1.0.0 to before 1.15.1 | 1.15.1 | Patch available | CNA |
| — | azure-identity (PyPI) | before 1.16.1 | 1.16.1 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | @azure/identity (npm) | before 4.2.1 | 4.2.1 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | com.azure:azure-identity (Maven) | before 1.12.2 | 1.12.2 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | @azure/msal-node (npm) | 2.7.0 to before 2.9.2 | 2.9.2 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | Microsoft.Identity.Client (NuGet) | 4.49.1 to before 4.60.4 | 4.60.4 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | github.com/Azure/azure-sdk-for-go/sdk/azidentity (Go) | before 1.6.0-beta.4.0.20240610221955-50774cd97099 | 1.6.0-beta.4.0.20240610221955-50774cd97099 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | com.microsoft.azure:msal4j (Maven) | 1.14.4-beta to before 1.15.1 | 1.15.1 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | Azure.Identity (NuGet) | before 1.11.4 | 1.11.4 | Patch available | GHSA-m5vv-6r4h-3vj9 |
| — | Microsoft.Identity.Client (NuGet) | 4.61.0 to before 4.61.3 | 4.61.3 | Patch available | GHSA-m5vv-6r4h-3vj9 |
- Azure Identity Library VendorMicrosoft Affected 1.0.0 to before 1.6.0 Fixed in 1.6.0 Patch available CNA
- Azure Identity Library for .NET VendorMicrosoft Affected 1.0.0 to before 1.11.4 Fixed in 1.11.4 Patch available CNA
- Azure Identity Library for C++ VendorMicrosoft Affected 1.0.0 to before 1.8.0 Fixed in 1.8.0 Patch available CNA
- Azure Identity Library for Java VendorMicrosoft Affected 1.0.0 to before 1.12.2 Fixed in 1.12.2 Patch available CNA
- Azure Identity Library for JavaScript VendorMicrosoft Affected 1.0.0 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
- Azure Identity Library for Python VendorMicrosoft Affected 1.0.0 to before 1.16.1 Fixed in 1.16.1 Patch available CNA
- Microsoft Authentication Library VendorMicrosoft Affected 1.0.0 to before 1.15.1 Fixed in 1.15.1 Patch available CNA
- azure-identity (PyPI) Vendor— Affected before 1.16.1 Fixed in 1.16.1 Patch available GHSA-m5vv-6r4h-3vj9
- @azure/identity (npm) Vendor— Affected before 4.2.1 Fixed in 4.2.1 Patch available GHSA-m5vv-6r4h-3vj9
- com.azure:azure-identity (Maven) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-m5vv-6r4h-3vj9
- @azure/msal-node (npm) Vendor— Affected 2.7.0 to before 2.9.2 Fixed in 2.9.2 Patch available GHSA-m5vv-6r4h-3vj9
- Microsoft.Identity.Client (NuGet) Vendor— Affected 4.49.1 to before 4.60.4 Fixed in 4.60.4 Patch available GHSA-m5vv-6r4h-3vj9
- github.com/Azure/azure-sdk-for-go/sdk/azidentity (Go) Vendor— Affected before 1.6.0-beta.4.0.20240610221955-50774cd97099 Fixed in 1.6.0-beta.4.0.20240610221955-50774cd97099 Patch available GHSA-m5vv-6r4h-3vj9
- com.microsoft.azure:msal4j (Maven) Vendor— Affected 1.14.4-beta to before 1.15.1 Fixed in 1.15.1 Patch available GHSA-m5vv-6r4h-3vj9
- Azure.Identity (NuGet) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-m5vv-6r4h-3vj9
- Microsoft.Identity.Client (NuGet) Vendor— Affected 4.61.0 to before 4.61.3 Fixed in 4.61.3 Patch available GHSA-m5vv-6r4h-3vj9
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:java:*:* | before 1.15.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:node.js:*:* | up to 2.9.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:.net:*:* | before 4.61.3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:go:*:* | before 1.6.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:c\+\+:*:* | before 1.8.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:.net:*:* | before 1.11.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:java:*:* | before 1.12.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:python:*:* | before 1.16.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:javascript:*:* | before 4.2.1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:java:*:* Versions before 1.15.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:node.js:*:* Versions up to 2.9.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:.net:*:* Versions before 4.61.3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:go:*:* Versions before 1.6.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:c\+\+:*:* Versions before 1.8.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:.net:*:* Versions before 1.11.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:java:*:* Versions before 1.12.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:python:*:* Versions before 1.16.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:javascript:*:* Versions before 4.2.1 Vulnerable ·Microsoft
Remediation
- Fix · CNA Azure Identity Library (Microsoft) Fixed in 1.6.0
- Fix · CNA Azure Identity Library for .NET (Microsoft) Fixed in 1.11.4
- Fix · CNA Azure Identity Library for C++ (Microsoft) Fixed in 1.8.0
- Fix · CNA Azure Identity Library for Java (Microsoft) Fixed in 1.12.2
- Fix · CNA Azure Identity Library for JavaScript (Microsoft) Fixed in 4.2.1
- Fix · CNA Azure Identity Library for Python (Microsoft) Fixed in 1.16.1
- Fix · CNA Microsoft Authentication Library (Microsoft) Fixed in 1.15.1
- Fix · GHSA-m5vv-6r4h-3vj9 azure-identity (PyPI) Fixed in 1.16.1 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 @azure/identity (npm) Fixed in 4.2.1 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 com.azure:azure-identity (Maven) Fixed in 1.12.2 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 @azure/msal-node (npm) Fixed in 2.9.2 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 Microsoft.Identity.Client (NuGet) Fixed in 4.60.4 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 github.com/Azure/azure-sdk-for-go/sdk/azidentity (Go) Fixed in 1.6.0-beta.4.0.20240610221955-50774cd97099 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 com.microsoft.azure:msal4j (Maven) Fixed in 1.15.1 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 Azure.Identity (NuGet) Fixed in 1.11.4 Advisory →
- Fix · GHSA-m5vv-6r4h-3vj9 Microsoft.Identity.Client (NuGet) Fixed in 4.61.3 Advisory →
Red Hat 2 advisories
- RHSA-2025:0536 Released 2025-01-21 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.15.0
- cert-manager operator for Red Hat OpenShift 1.15 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2024:7052 Released 2024-09-24 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA)
- Red Hat build of Apache Camel 4 for Quarkus 3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Fixed | RHSA-2024:7052 |
| cert-manager operator for Red Hat OpenShift 1.15 | Fixed | RHSA-2025:0536 |
Not affected: 10 products
- Exploit Intelligence
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 10
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Openshift Data Foundation 4
- Red Hat build of Apache Camel for Spring Boot 4
Microsoft
Microsoft's page for this CVE →
- Impact
- Elevation of Privilege
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| Azure Identity Library for .NET | Fixed | 1.11.4 · Security Update |
| Azure Identity Library for C++ | Fixed | 1.8.0 · Security Update |
| Azure Identity Library for Go | Fixed | 1.6.0 · Security Update |
| Azure Identity Library for Java | Fixed | 1.12.2 · Security Update |
| Azure Identity Library for JavaScript | Fixed | 4.2.1 · Security Update |
| Azure Identity Library for Python | Fixed | 1.16.1 · Security Update |
| Microsoft Authentication Library (MSAL) for .NET | Fixed | 4.61.3 · Security Update |
| Microsoft Authentication Library (MSAL) for Java | Fixed | 1.15.1 · Security Update |
| Microsoft Authentication Library (MSAL) for Node.js | Fixed | 2.9.2 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-35255
- 2026-10-03 Alias added: GHSA-m5vv-6r4h-3vj9
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 1
Other 6
- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340
- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499
- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d
- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492
- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53
- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178
More Microsoft Authentication Library vulnerabilities
- TI-2019-01181 Information disclosure in Microsoft Authentication Library for Android CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-35255 · CVE Program
- CVE-2024-35255 · NVD
- FIRST EPSS
- GHSA-m5vv-6r4h-3vj9 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-35255 · Microsoft Security Update Guide
- CVE-2024-35255 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences