CVE-2016-7191

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the…

published September 28, 2016

CVSS

—

EPSS

29%

Percentile

98.2

In the wild

Unconfirmed

What it is

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.29448 · 98.2th percentile
Published: 2016-09-28T20:00Z

EPSS history

Timeline

28 SEP 20:00Z
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the…
cvelistv5