CVE-2026-45108: fallo de gravedad alta en himmelblau-idm himmelblau
Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.2%
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Productos afectados
himmelblau-idm · himmelblauCVEs relacionadas — himmelblau-idm himmelblau
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-31957CRITICALHimmelblau unset domain configuration can allow any-tenant authentication at first login for remote deploymentsEPSS 0.6%CVE-2025-49012MEDIUMHimmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security BypassEPSS 0.4%CVE-2025-54882HIGHHimmelblau's Kerberos credential cache collection is world readableEPSS 0.2%CVE-2026-31979HIGHhimmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccacheEPSS 0.2%CVE-2025-53013MEDIUMHimmelblau offline auth permits authentication with invalid Hello PINEPSS 0.2%CVE-2025-24034LOWHimmelblau leaks credentials in the debug logEPSS 0.2%