CVE-2025-66390: Azure API Management Auth Bypass Flaw

CVE-2025-66390 Overview

CVE-2025-66390 describes a broken access control issue [CWE-284] in Microsoft Azure API Management through 2025-10-17. When self-service signup using username/password Basic Authentication is enabled in one tenant, the underlying registration API endpoint accepts cross-tenant requests based on the Host header. An attacker can reuse the registration flow by changing the hostname or tenant identifier to reach a second tenant, even when that tenant has signup disabled in the UI. Disabling signup in the developer portal UI does not disable the backend endpoint.

Critical Impact
Microsoft evaluated the report and determined it did not cross a security boundary, classifying the observed behavior as a configuration or state issue rather than an exploitable product vulnerability affecting tenant isolation.

Affected Products

Microsoft Azure API Management (developer portal / self-service signup flow) through 2025-10-17
Tenants with username/password Basic Authentication signup enabled in any linked tenant
Deployments relying on UI-level signup toggles for access restriction

Discovery Timeline

2026-07-21 - CVE-2025-66390 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2025-66390

Vulnerability Analysis

The vulnerability lies in how Azure API Management routes self-service signup requests. The developer portal exposes a UI toggle to enable or disable signup per tenant. Disabling this toggle removes the signup form from the rendered portal but does not deregister or disable the corresponding backend registration endpoint. The endpoint continues to accept authenticated registration payloads and routes them by inspecting the Host header of the incoming HTTP request.

An attacker who identifies any tenant (Tenant A) with signup enabled can capture the registration request. The attacker then replays that request while substituting the Host header or tenant identifier for a target tenant (Tenant B). The backend processes the request against Tenant B even though Tenant B disabled signup at the UI layer. The result is account creation in a tenant that administrators believed was closed to public registration.

Microsoft's position is that this behavior does not violate a documented tenant isolation boundary and is a configuration state issue.

Root Cause

The root cause is a missing server-side enforcement check that ties the UI-level signup configuration to the backend registration endpoint. Access control decisions rely on client-facing UI state rather than authoritative per-tenant policy evaluation at the API layer [CWE-284].

Attack Vector

The attack is network-based and unauthenticated. An attacker enumerates Azure API Management developer portals, locates one instance with self-service signup active, and reuses the observed HTTP registration flow. By altering the Host header or tenant hostname parameter, the attacker directs the request to any other reachable APIM tenant. No user interaction is required. Technical details and proof-of-concept material are published in the GitHub PoC Repository and the GitHub Security Advisory GHSA-vcwf-73jp-r7mv.

Detection Methods for CVE-2025-66390

Indicators of Compromise

Unexpected new developer accounts in APIM tenants where the signup UI is disabled
HTTP POST requests to the APIM signup endpoint with Host headers that do not match the tenant's canonical hostname
Registration events originating from IP addresses or user agents inconsistent with legitimate developer traffic

Detection Strategies

Correlate APIM audit logs for NewUser or UserCreated events against the tenant's documented signup policy state
Alert when signup events occur in tenants whose portal configuration shows signup as disabled
Inspect Application Gateway or Front Door logs for cross-tenant Host header mismatches on /signup and identity endpoints

Monitoring Recommendations

Forward Azure APIM diagnostic logs and Azure Activity Logs to a centralized analytics platform for continuous review
Baseline the expected registration volume per tenant and alert on deviations
Review developer group membership on a scheduled cadence to identify unauthorized accounts

How to Mitigate CVE-2025-66390

Immediate Actions Required

Disable username/password Basic Authentication signup across all APIM tenants that do not explicitly require it
Enforce identity provider federation (Entra ID or Entra ID B2C) for developer portal authentication
Audit existing developer accounts and remove any that cannot be attributed to a legitimate registration
Restrict access to the developer portal and its API endpoints through networking controls such as private endpoints or IP allowlists

Patch Information

Microsoft has stated the behavior does not cross a security boundary and has not issued a product patch. Remediation depends on configuration hardening. Refer to the GitHub Security Advisory GHSA-vcwf-73jp-r7mv for current guidance.

Workarounds

Replace Basic Authentication signup with federated identity providers on every APIM instance in the subscription
Place the developer portal behind Azure Front Door or Application Gateway with WAF rules that block requests carrying non-canonical Host headers
Apply APIM policies at the inbound stage to reject requests to signup routes when the tenant is not intended to accept public registration

bash

# Example: Disable Basic Authentication signup via Azure CLI
az apim update \
  --name <apim-instance-name> \
  --resource-group <resource-group> \
  --set properties.signupSettings.enabled=false

# Verify current signup configuration
az rest --method get \
  --uri "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.ApiManagement/service/<apim>/portalsettings/signup?api-version=2022-08-01"