CVE-2026-33843: Microsoft Entra ID Auth Bypass Flaw

CVE-2026-33843 Overview

CVE-2026-33843 is an authentication bypass vulnerability in Microsoft Azure Active Directory B2C, part of the Microsoft Entra ID identity platform. The flaw allows an unauthenticated attacker to elevate privileges over a network by using an alternate path or channel that circumvents the intended authentication flow. The weakness is tracked under CWE-288, Authentication Bypass Using an Alternate Path or Channel. Microsoft has published guidance through the Microsoft Security Update CVE-2026-33843 advisory.

Critical Impact
An unauthenticated network attacker can bypass authentication in Azure AD B2C and elevate privileges, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Entra ID
Microsoft Azure Active Directory B2C
Tenants relying on Entra ID B2C for customer identity and access management

Discovery Timeline

2026-05-22 - CVE-2026-33843 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-33843

Vulnerability Analysis

The vulnerability resides in the authentication logic of Azure Active Directory B2C, the customer-facing identity service within Microsoft Entra ID. An attacker can reach an alternate code path or channel that performs authentication or session establishment without enforcing the intended identity checks. Because the issue is network-reachable and requires no privileges or user interaction, exploitation produces a direct privilege elevation against the targeted tenant.

Successful exploitation allows an adversary to act as another principal within the B2C directory. The downstream effect is unauthorized access to applications and APIs that delegate authentication to the affected tenant, with potential read, write, and disruption of protected resources.

Root Cause

The weakness is classified under [CWE-288], where a security control can be skipped by reaching the protected functionality through a path that does not invoke the authentication routine. In B2C scenarios, this typically involves token issuance, federation callbacks, or policy-driven user journeys where validation of a required claim, signature, or state parameter is missing or inconsistently applied across endpoints.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker crafts requests to the alternate channel exposed by the affected B2C endpoints and obtains tokens or session material associated with a higher-privileged principal. The vulnerability has been mitigated by Microsoft as a service-side fix, and customers do not deploy a binary patch. See the Microsoft Security Update for vendor-confirmed technical details.

Detection Methods for CVE-2026-33843

Indicators of Compromise

Sign-in events in Entra ID audit logs showing successful authentication without a corresponding interactive or federated step
Token issuance to applications from user objects that have no prior sign-in history or originate from unexpected geographies
Unusual calls to B2C policy endpoints, /authorize, or /token from a single source enumerating multiple identifiers
New or modified application consents, role assignments, or directory role memberships immediately following anomalous sign-ins

Detection Strategies

Correlate Entra ID sign-in logs with application access logs to identify tokens used without a matching authentication event
Hunt for B2C user flow executions that complete with missing or malformed claims expected by the policy
Alert on privilege changes performed by accounts that authenticated through B2C rather than through workforce Entra ID

Monitoring Recommendations

Stream Entra ID SignInLogs, AuditLogs, and RiskyUsers events into a SIEM and retain for forensic review
Enable Microsoft Entra ID Protection risk policies and review high-risk sign-ins daily during the exposure window
Monitor application registrations and service principal credential additions for unexpected changes

How to Mitigate CVE-2026-33843

Immediate Actions Required

Review the Microsoft Security Update CVE-2026-33843 advisory and confirm tenant status
Audit Entra ID B2C user flows, custom policies, and identity providers for unexpected modifications since May 2026
Rotate signing keys and client secrets for applications integrated with affected B2C tenants
Revoke active refresh tokens for high-privilege users and force re-authentication

Patch Information

Microsoft has addressed CVE-2026-33843 as a service-side mitigation in Microsoft Entra ID. No customer-deployed update is required for the platform fix itself. Customers should still validate their tenant configuration and apply the hardening guidance referenced in the Microsoft Security Response Center advisory.

Workarounds

Enforce conditional access policies that require multi-factor authentication for all administrative and high-value applications
Restrict B2C application access using IP-based conditional access and named locations where feasible
Disable unused identity providers and legacy authentication flows in B2C tenants to reduce the available attack surface

bash

# Review recent privileged role assignments in Entra ID using Microsoft Graph PowerShell
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","AuditLog.Read.All"
Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add member to role'" `
  | Where-Object { $_.ActivityDateTime -ge (Get-Date).AddDays(-30) } `
  | Select-Object ActivityDateTime, InitiatedBy, TargetResources