CVE-2026-80092: Microsoft Identity Web Auth Bypass Flaw

CVE-2026-80092 Overview

CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web. The flaw stems from the library trusting data that was assumed to be immutable but can be influenced by an attacker. An authorized attacker with low privileges can leverage this weakness to elevate privileges across a network. The issue is tracked under CWE-302: Authentication Bypass by Assumed-Immutable Data.

Microsoft Identity Web is a .NET authentication library used by ASP.NET Core applications to integrate with the Microsoft identity platform and Entra ID. Successful exploitation gives an attacker access to resources they should not be able to reach, undermining the trust boundary enforced by the identity layer.

Critical Impact

An authorized network attacker can bypass authentication checks in Microsoft Identity Web and elevate privileges, breaching the confidentiality of protected resources.

Affected Products

• Microsoft Identity Web library
• ASP.NET Core applications that depend on Microsoft Identity Web for authentication
• Downstream services relying on Microsoft Identity Web token validation

Discovery Timeline

• 2026-10-16 - CVE-2026-80092 published to the National Vulnerability Database
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-80092

Vulnerability Analysis

The vulnerability lives in the authentication logic of Microsoft Identity Web. The library treats certain claim or token data as immutable and uses it to make trust decisions. In practice, that data can be manipulated by an authorized caller. When the library consumes the tampered value, it grants access or privileges beyond what the identity should hold.

The attack requires low privileges and no user interaction, but Microsoft rates the attack complexity as high. The impact is scoped to confidentiality, with integrity and availability unaffected. An attacker who already holds a valid identity in the target environment is the most likely abuser of this flaw.

Microsoft has not published root-cause detail beyond the advisory. Review the Microsoft CVE-2026-80092 Update Guide for official guidance.

Root Cause

The root cause is classified as CWE-302: the application makes an authentication decision based on a value it assumes cannot change. When that assumption fails, the authentication boundary fails with it. In token-based systems, this pattern typically appears when a claim, header, or cached identifier is trusted without re-validation against the identity provider.

Attack Vector

Exploitation occurs over the network against an application that embeds Microsoft Identity Web. The attacker must already be authenticated to the target system. By crafting a request containing manipulated identity data, the attacker causes the library to authorize an action associated with a higher-privileged principal. No code execution occurs on the server; the impact is unauthorized access to protected resources.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-80092

Indicators of Compromise

• Authenticated sessions accessing resources outside the user's assigned role or scope
• Repeated requests from the same identity with varying claim values or token headers
• Audit log entries showing privilege-sensitive operations performed by low-privilege accounts
• Token validation warnings or anomalies emitted by Microsoft Identity Web middleware

Detection Strategies

• Correlate authentication events with downstream authorization decisions to find mismatches between the acting identity and the operation performed
• Baseline normal claim sets per user and alert when inbound requests present unexpected claims or modified identifiers
• Monitor Entra ID sign-in logs for successful token issuance followed by anomalous application behavior from the same session

Monitoring Recommendations

• Ingest ASP.NET Core authentication and authorization logs into a central SIEM for correlation
• Enable verbose logging in Microsoft Identity Web during the investigation window to capture claim-level decisions
• Track versions of the Microsoft.Identity.Web NuGet package deployed across your estate and alert on vulnerable versions in production

How to Mitigate CVE-2026-80092

Immediate Actions Required

• Inventory all applications that reference the Microsoft.Identity.Web package and identify versions in use
• Apply the patched Microsoft Identity Web release listed in the Microsoft Security Response Center advisory
• Review audit logs for signs of privilege escalation performed by authenticated low-privilege users
• Rotate any credentials or tokens that may have been exposed through improper authorization

Patch Information

Microsoft has published remediation details in the Microsoft CVE-2026-80092 Update Guide. Update the Microsoft.Identity.Web NuGet package to the fixed version indicated in the advisory, then redeploy affected ASP.NET Core applications. Confirm the fix propagates to all build pipelines and container images.

Workarounds

• Enforce least privilege on all identities that can authenticate to affected applications to reduce blast radius
• Add server-side authorization checks that re-validate the acting principal against the identity provider rather than trusting cached claim data
• Restrict network reachability of affected applications to known client ranges until patching is complete
• Require conditional access policies in Entra ID that limit high-privilege operations to compliant devices and known locations

# Update the Microsoft Identity Web package in an ASP.NET Core project
dotnet add package Microsoft.Identity.Web --version <patched-version>
dotnet restore
dotnet build --configuration Release