Displaying items by tag: azure ad

Microsoft’s Azure AD, the cloud-based flavor of the on-premises service is an interesting construct. On the surface you think that it has some decent protections enabled by default. The sad truth of the matter is that this is not the case and many options for security are very lacking until you hit much higher security levels. If you add to this equation the likelihood of vulnerabilities and other flaws that can allow an attacker to bypass the security options that are already there it is a bit of a mess. This wonderful thought is what brings us to today’s flaw. According to security researchers, there is a flaw in how Microsoft Azure AD processes its implementation of OAuth (Open Authentication).