{"id":"CVE-2026-80092","kind":"vulnerability","aliases":["CVE-2026-80092"],"related":[],"title":"Microsoft Identity Web: authenticated users can elevate privileges over the network","description":"Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft Identity Web, a library for authenticating users against Microsoft Entra ID in .NET apps, trusts data it assumed could not change, so an authenticated attacker can bypass authentication checks. The sources say an attacker who already has access can elevate privileges over the network.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","entra-id","microsoft-identity-web","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T18:18:37+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:58+00:00","updated_at":"2026-10-25T04:26:58+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:26:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Identity Web: authenticated users can elevate privileges over the network","impact":"medium","summary":"Microsoft Identity Web, a library for authenticating users against Microsoft Entra ID in .NET apps, trusts data it assumed could not change, so an authenticated attacker can bypass authentication checks. The sources say an attacker who already has access can elevate privileges over the network.","category":"package","nicknames":[],"who_cares":["dotnet","microsoft-identity-web","entra-id"],"confidence":0.4,"needs_auth":"yes","worst_case":"authenticated attacker gains elevated privileges in the application","analyst_note":"Find the Microsoft advisory for CVE-2026-80092 to get affected and fixed package versions, and the specific code path or configuration involved.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources do not list affected versions or the exact configuration. Teams using Microsoft Identity Web in their apps should check their installed package versions against the advisory once it lists them.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000539,"input_tokens":3268,"output_tokens":425,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-80092':14A,17A 'access':65B 'allow':83C 'alreadi':63B 'app':41B 'assum':45B,76C 'assumed-immut':75C 'attack':52B,61B,86C 'authent':4A,33B,51B,55B,72C 'author':85C 'bypass':54B,73C 'chang':48B 'check':56B 'could':46B 'cve':12A,15A 'data':43B,78C 'dotnet':18B 'elev':7A,67B,88C 'entra':20B,37B 'entra-id':19B 'id':21B,38B 'ident':2A,24B,28B,81C 'immut':77C 'librari':31B 'microsoft':1A,23B,27B,36B,80C 'microsoft-identity-web':22B 'net':40B 'network':11A,71B,92C 'packag':26B 'privileg':8A,68B,89C 'say':59B 'sourc':58B 'trust':42B 'user':5A,34B 'web':3A,25B,29B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-80092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80092","severity":null,"published_at":"2026-10-16T18:18:37+00:00","modified_at":"2026-10-20T14:17:03+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}