Vulnerabilities

TI-2026-32945 CVE-2026-45108

Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

LOW 38

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1HIGH 8.4 Network Low privileges No interaction EPSS 0.00246 Published 2026-05-27 Fixed in 2.3.11, 3.1.5 CWE-863

TI-2026-26683 CVE-2026-34397

himmelblau: NSS fake-primary group lookup reintroduces name collision risk

HIGH 66

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00164 Published 2026-04-01 Fixed in 2.3.9, 3.1.1 CWE-269

TI-2026-24522 CVE-2026-31979

himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache

HIGH 73

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00232 Published 2026-03-11 Fixed in 2.3.8, 3.1.0 CWE-59

TI-2026-24501 CVE-2026-31957

Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments

MEDIUM 50

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0057 Published 2026-03-11 Fixed in 3.1.0 CWE-1188

TI-2025-36686 CVE-2025-59044

Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)

LOW 19

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00145 Published 2025-09-09 Fixed in 0.9.23 CWE-1188

TI-2025-34616 CVE-2025-54882

Himmelblau's Kerberos credential cache collection is world readable

HIGH 66

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00252 Published 2025-08-07 Fixed in 0.9.22, 1.2.0 CWE-522

TI-2025-34536 CVE-2025-54781

Himmelblau leaks an Intune service access token in its logs

LOW 13

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1LOW 2.8 Local High privileges User interaction EPSS 0.00164 Published 2025-08-01 Fixed in 1.1.0 CWE-532

TI-2025-33017 CVE-2025-53013

Himmelblau offline auth permits authentication with invalid Hello PIN

LOW 23

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1MEDIUM 5.2 Physical No auth No interaction EPSS 0.0023 Published 2025-06-26 Fixed in 0.9.17 CWE-287

TI-2025-31140 CVE-2025-49012

Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass

LOW 24

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-06-05 Fixed in 0.9.15 CWE-287

TI-2025-17801 CVE-2025-24034

Himmelblau leaks credentials in the debug log

LOW 15

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.

CVSS 3.1LOW 3.2 Local High privileges No interaction EPSS 0.00201 Published 2025-01-23 Fixed in 0.7.15, 0.8.3 CWE-532

Vulnerabilities

Filters