Full Report
A critical combination of legacy components could have allowed complete access to the Microsoft Entra ID tenant of every company in the world. [...]
Analysis Summary
# Vulnerability: Complete Microsoft Entra ID Tenant Hijacking via Actor Token and Graph API Flaw
## CVE Details
- CVE ID: CVE-2025-55241
- CVSS Score: Not explicitly provided, context suggests Critical severity ("critical combination," "complete access")
- CWE: Likely related to Improper Access Control or Broken Authentication/Authorization
## Affected Systems
- Products: Microsoft Entra ID (formerly Azure Active Directory), Azure AD Graph API (`graph.windows.net`)
- Versions: Any configuration relying on legacy Access Control Service-issued "actor tokens" interacting with the deprecated Azure AD Graph API.
- Configurations: Environments utilizing applications configured for "extended access" to the Azure AD Graph API that were not migrated before the deprecation deadline.
## Vulnerability Description
The vulnerability stems from a combination of two factors: the existence of undocumented, unsigned "actor tokens" issued by a legacy Access Control Service (used by components like hybrid Exchange setups), and a flaw in the deprecated Azure AD Graph API (`graph.windows.net`).
Actor tokens:
1. Are **unsigned**.
2. Are valid for **24 hours** and cannot be revoked during this period.
3. Generate **no logs** when issued or used, bypassing Conditional Access policies.
An attacker could craft an impersonation token using an actor token obtained from a tenant they control, substituting the target tenant ID and the `netId` of a legitimate user within the target tenant. When sent to the Azure AD Graph API, this improperly validated token allowed the attacker to impersonate any user, including the **Global Administrator**, in the victim tenant, leading to complete tenant compromise.
## Exploitation
- Status: **PoC available** (Proof of concept demonstrated by researcher Dirk-jan Mollema)
- Complexity: Implies **Medium** to **Low** complexity once the initial actor token is obtained, as steps involve public information gathering (Tenant ID, user netId) and token crafting.
- Attack Vector: **Network** (API interaction)
## Impact
- Confidentiality: **High** (Access to all data accessible by Global Admin)
- Integrity: **High** (Ability to modify configurations, manage users/roles, reset passwords)
- Availability: **High** (Ability to lock out legitimate administrators or disrupt services)
## Remediation
### Patches
- **CVE-2025-55241 patched** by Microsoft on September 4, 2025.
- **Action required:** Ensure all organizational dependencies on the Azure AD Graph API are migrated to the Microsoft Graph API before the final service termination date.
### Workarounds
- **Immediate Migration:** Complete the migration of any applications still using legacy Azure AD Graph API calls to the modern Microsoft Graph API.
- **Monitoring:** Closely monitor endpoints that communicate with the Azure AD Graph API for unusual activity, although the vulnerability mitigates exploitation rather than detecting existing unauthorized use (as logging of token usage was poor).
## Detection
- **Indicators of Compromise (IoCs):** Activity related to the Azure AD Graph API (`graph.windows.net`) showing successful read/write operations originating from potentially suspicious tokens.
- **Detection methods and tools:**
- Monitor Azure AD audit/sign-in logs for administrative actions performed without corresponding initial authentication events (if the successful write operation was the only logged step).
- Focus detection efforts on applications/services utilizing the deprecated Graph API endpoints.
## References
- [Vendor Advisory - MSRC Vulnerability Page for CVE-2025-55241](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241)
- [Researcher Disclosure Blog Post](https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/)