Read the docs
TI-2025-23140 Aliases CVE-2025-32016GHSA-rpq8-q44m-2rpg

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Priority LOW 20CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform (formerly Azure AD v2.0 endpoint) and AAD B2C. This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely. Service logs generated at the information level or credential descriptions containing local file paths with passwords, Base64 encoded values, or Client secret. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status. To mitigate this vulnerability, update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00098 0th percentileScored 2026-11-07
Fix Fixed microsoft-identity-web (AzureAD): 3.8.2Microsoft.Identity.Web (NuGet): 3.8.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzureADmicrosoft-identity-web3.2.0 to before 3.8.23.8.2Patch availableCNA
—Microsoft.Identity.Web (NuGet)3.2.0 to before 3.8.23.8.2Patch availableGHSA-rpq8-q44m-2rpg
—Microsoft.Identity.Abstractions (NuGet)7.1.0 to before 9.0.09.0.0Patch availableGHSA-rpq8-q44m-2rpg
  • microsoft-identity-web VendorAzureAD Affected 3.2.0 to before 3.8.2 Fixed in 3.8.2 Patch available CNA
  • Microsoft.Identity.Web (NuGet) Vendor— Affected 3.2.0 to before 3.8.2 Fixed in 3.8.2 Patch available GHSA-rpq8-q44m-2rpg
  • Microsoft.Identity.Abstractions (NuGet) Vendor— Affected 7.1.0 to before 9.0.0 Fixed in 9.0.0 Patch available GHSA-rpq8-q44m-2rpg

Remediation

  • Fix · CNA microsoft-identity-web (AzureAD) Fixed in 3.8.2
  • Fix · GHSA-rpq8-q44m-2rpg Microsoft.Identity.Web (NuGet) Fixed in 3.8.2 Advisory →
  • Fix · GHSA-rpq8-q44m-2rpg Microsoft.Identity.Abstractions (NuGet) Fixed in 9.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32016
  2. 2026-10-03 Alias added: GHSA-rpq8-q44m-2rpg

References

Advisory 1

Other 2

  • TI-2024-17948 MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service CVSS 3.1LOW 3.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences