Researcher discloses five cross-tenant Azure API vulnerabilities worth $200K
Security researcher details architectural flaws in Azure Logic Apps API Connections that allow full compromise across tenant boundaries.
What to know
- Five vulnerabilities in Azure Logic Apps API Connections allow attackers to compromise any connection across tenant boundaries and access victim backends including Key Vaults and SQL databases.
- The core issue stems from insecure architecture that allows path traversal via ARM REST API endpoints (DynamicInvoke and /extensions/proxy) to trick API Management into operating on connections owned by other tenants.
- Most organizations do not scope API Connection privileges minimally, leaving backends exposed with full victim credentials or OAuth tokens.
- Researcher earned $200,000 in bug bounties and presented findings at Blue Hat Asia 2026.
Binary Security researcher Security researcher, bug bounty recipientMicrosoft Azure service provider
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
2
Researcher presents vulnerability details at Blue Hat Asia 2026
The security researcher gave a talk at Blue Hat Asia 2026 detailing the API Connections vulnerabilities, with recordings to follow.
-
That's me. But I don't understand your comment. Could you expand on it, either in a reply or preferably by email or via an MSRC case? You can reply with the vuln number so I can fast route it.> The callback you're redirecting the user to at the end of that flow is forgeableThe redirect_uri is checked against the app registration. There's a general…
2 more of the top 3 · 13 posts in this stretch
-
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to…
-
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a different middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket…
-
-
1
Researcher publishes five cross-tenant compromise vulnerabilities in Azure API Connections
Security researcher detailed a series of vulnerabilities in Azure Logic Apps' API Connections architecture that enable attackers to compromise any connection worldwide and access victim backends including Key Vaults, SQL databases, Jira, and Salesforce. The research builds on two previous posts in the series and earned the researcher $200,000 in bug bounties.
“API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend.”
— Binary Security researcher -
first by HN Best, 12d ago · also HN Frontpage
-
What people are saying 10 voices from 1 site · best of 13 · verbatim
- Oct 31
-
>> The original RuntimeUrl path was no longer validated, and as a result, you could perform that attack again. I would include some pictures, but they would be the same pictures as above, so you can just imagine them.Such kindness & grace shown by the author. He/she could have ripped azure furthermore so easily.
- Oct 30
-
I'm sure one of the 60,000 employees who have been told they're welcome not to work there anymore, because the line must go up infinitely, will be chomping at the bit to do so.
-
I love that this is the most reliable way to actually contact an actual human working at Microsoft
-
“Go to the cloud!”, they said.The cloud:Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.
-
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
-
Ok so.Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).Vulnerability was reported.They fixed it - incorrectly. Reported again.They fixed it this time... and broke the previous fix. So it's vulnerable again.What a clown show.
-
maybe we should tag submissions with dates now?[2026-10-02]beginning of curent month feels like two years ago when multiple vulns drop daily
-
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.Should have been addressed in the Geneva conventions.
-
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
-
path traversal and IDOR..likely been active since the inception of these capabilitieswonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)