All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-31957
CRITICALpublished 2026-03-11 20:16 UTC · 5 months ago · modified 2026-06-17 10:34 UTC
10.0
CVSS / 10
// description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not tenant-scoped. In this mode, Himmelblau can accept authentication attempts for arbitrary Entra ID domains by dynamically registering providers at runtime. This behavior is intended for initial/local bootstrap scenarios, but it can create risk in remote authentication environments. This vulnerability is fixed in 3.1.0.
// weaknesses (CWE)
- CWE-1188