Read the docs
TI-2026-32945 Aliases CVE-2026-45108

Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed himmelblau (himmelblau-idm): 2.3.11, 3.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
himmelblau-idmhimmelblau2.0.0 to before 2.3.11; 3.0.0-alpha to before 3.1.52.3.11, 3.1.5Patch availableCNA
  • himmelblau Vendorhimmelblau-idm Affected 2.0.0 to before 2.3.11; 3.0.0-alpha to before 3.1.5 Fixed in 2.3.11, 3.1.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*——himmelblau-idm
  • cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* Versions — — ·himmelblau-idm

Remediation

  • Fix · CNA himmelblau (himmelblau-idm) Fixed in 2.3.11, 3.1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45108

References

Other 1

  • TI-2026-24522 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache CVSS 3.1HIGH 8.8
  • TI-2026-26683 himmelblau: NSS fake-primary group lookup reintroduces name collision risk CVSS 3.1HIGH 7.0
  • TI-2025-34616 Himmelblau's Kerberos credential cache collection is world readable CVSS 3.1HIGH 7.1
  • TI-2026-24501 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments CVSS 3.1CRITICAL 10.0
  • TI-2025-31140 Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass CVSS 3.1MEDIUM 5.4
  • TI-2025-33017 Himmelblau offline auth permits authentication with invalid Hello PIN CVSS 3.1MEDIUM 5.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences