CVE-2026-31957CWE-1188

Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments

Critical · published March 11, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not tenant-scoped. In this mode, Himmelblau can accept authentication attempts for arbitrary Entra ID domains by dynamically registering providers at runtime. This behavior is intended for initial/local bootstrap scenarios, but it can create risk in remote authentication environments. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00762 · 54.9th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-03-11T19:25Z
EPSS history
Timeline
  • 11 MAR 19:25Z
    Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
    cvelistv5