---
id: "CVE-2026-80092"
kind: "vulnerability"
aliases: ["CVE-2026-80092"]
title: "Microsoft Identity Web: authenticated users can elevate privileges over the network"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "entra-id", "microsoft-identity-web", "package"]
not_affected_if: []
published_at: "2026-10-16T18:18:37+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80092", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Microsoft Identity Web: authenticated users can elevate privileges over the network

Microsoft Identity Web, a library for authenticating users against Microsoft Entra ID in .NET apps, trusts data it assumed could not change, so an authenticated attacker can bypass authentication checks. The sources say an attacker who already has access can elevate privileges over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-80092

## From the sources

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_