CVE-2026-33843: Microsoft Entra ID Auth Bypass Flaw

CVE-2026-33843 Overview

CVE-2026-33843 is an authentication bypass vulnerability in Microsoft Azure Active Directory B2C, part of the Microsoft Entra ID identity platform. The flaw allows an unauthenticated attacker to elevate privileges over a network by using an alternate path or channel that circumvents the intended authentication flow. The weakness is tracked under CWE-288, Authentication Bypass Using an Alternate Path or Channel. Microsoft has published guidance through the Microsoft Security Update CVE-2026-33843 advisory.

Critical Impact

An unauthenticated network attacker can bypass authentication in Azure AD B2C and elevate privileges, with high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft Entra ID
• Microsoft Azure Active Directory B2C
• Tenants relying on Entra ID B2C for customer identity and access management

Discovery Timeline

• 2026-05-22 - CVE-2026-33843 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-33843

Vulnerability Analysis

The vulnerability resides in the authentication logic of Azure Active Directory B2C, the customer-facing identity service within Microsoft Entra ID. An attacker can reach an alternate code path or channel that performs authentication or session establishment without enforcing the intended identity checks. Because the issue is network-reachable and requires no privileges or user interaction, exploitation produces a direct privilege elevation against the targeted tenant.

Successful exploitation allows an adversary to act as another principal within the B2C directory. The downstream effect is unauthorized access to applications and APIs that delegate authentication to the affected tenant, with potential read, write, and disruption of protected resources.

Root Cause

The weakness is classified under [CWE-288], where a security control can be skipped by reaching the protected functionality through a path that does not invoke the authentication routine. In B2C scenarios, this typically involves token issuance, federation callbacks, or policy-driven user journeys where validation of a required claim, signature, or state parameter is missing or inconsistently applied across endpoints.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker crafts requests to the alternate channel exposed by the affected B2C endpoints and obtains tokens or session material associated with a higher-privileged principal. The vulnerability has been mitigated by Microsoft as a service-side fix, and customers do not deploy a binary patch. See the Microsoft Security Update for vendor-confirmed technical details.

Detection Methods for CVE-2026-33843

Indicators of Compromise

• Sign-in events in Entra ID audit logs showing successful authentication without a corresponding interactive or federated step
• Token issuance to applications from user objects that have no prior sign-in history or originate from unexpected geographies
• Unusual calls to B2C policy endpoints, /authorize, or /token from a single source enumerating multiple identifiers
• New or modified application consents, role assignments, or directory role memberships immediately following anomalous sign-ins

Detection Strategies

• Correlate Entra ID sign-in logs with application access logs to identify tokens used without a matching authentication event
• Hunt for B2C user flow executions that complete with missing or malformed claims expected by the policy
• Alert on privilege changes performed by accounts that authenticated through B2C rather than through workforce Entra ID

Monitoring Recommendations

• Stream Entra ID SignInLogs, AuditLogs, and RiskyUsers events into a SIEM and retain for forensic review
• Enable Microsoft Entra ID Protection risk policies and review high-risk sign-ins daily during the exposure window
• Monitor application registrations and service principal credential additions for unexpected changes

How to Mitigate CVE-2026-33843

Immediate Actions Required

• Review the Microsoft Security Update CVE-2026-33843 advisory and confirm tenant status
• Audit Entra ID B2C user flows, custom policies, and identity providers for unexpected modifications since May 2026
• Rotate signing keys and client secrets for applications integrated with affected B2C tenants
• Revoke active refresh tokens for high-privilege users and force re-authentication

Patch Information

Microsoft has addressed CVE-2026-33843 as a service-side mitigation in Microsoft Entra ID. No customer-deployed update is required for the platform fix itself. Customers should still validate their tenant configuration and apply the hardening guidance referenced in the Microsoft Security Response Center advisory.

Workarounds

• Enforce conditional access policies that require multi-factor authentication for all administrative and high-value applications
• Restrict B2C application access using IP-based conditional access and named locations where feasible
• Disable unused identity providers and legacy authentication flows in B2C tenants to reduce the available attack surface

# Review recent privileged role assignments in Entra ID using Microsoft Graph PowerShell
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","AuditLog.Read.All"
Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add member to role'" `
  | Where-Object { $_.ActivityDateTime -ge (Get-Date).AddDays(-30) } `
  | Select-Object ActivityDateTime, InitiatedBy, TargetResources