Researcher presents vulnerability details at Blue Hat Asia 2026
2 Oct 30 · 12d ago · 1 post · 1 source · development 2 of 2
The security researcher gave a talk at Blue Hat Asia 2026 detailing the API Connections vulnerabilities, with recordings to follow.
Binary Security researcher Security researcher, bug bounty recipientMicrosoft Azure service provider
The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump
What people said 13 voices · verbatim
-
That's me. But I don't understand your comment. Could you expand on it, either in a reply or preferably by email or via an MSRC case? You can reply with the vuln number so I can fast route it.> The callback you're redirecting the user to at the end of that flow is forgeableThe redirect_uri is checked against the app registration. There's a general…
-
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to…
-
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a different middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket…
-
>> The original RuntimeUrl path was no longer validated, and as a result, you could perform that attack again. I would include some pictures, but they would be the same pictures as above, so you can just imagine them.Such kindness & grace shown by the author. He/she could have ripped azure furthermore so easily.
-
Ok so.Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).Vulnerability was reported.They fixed it - incorrectly. Reported again.They fixed it this time... and broke the previous fix. So it's vulnerable again.What a clown show.
-
path traversal and IDOR..likely been active since the inception of these capabilitieswonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
-
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.Should have been addressed in the Geneva conventions.
-
“Go to the cloud!”, they said.The cloud:Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.
-
I'm sure one of the 60,000 employees who have been told they're welcome not to work there anymore, because the line must go up infinitely, will be chomping at the bit to do so.
-
maybe we should tag submissions with dates now?[2026-10-02]beginning of curent month feels like two years ago when multiple vulns drop daily
-
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
-
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
-
I love that this is the most reliable way to actually contact an actual human working at Microsoft
All 2 developments of Researcher discloses five cross-tenant Azure API… →
LobstersHacker NewsNewswiresMastodon