CVE-2026-80092: Medium severity Microsoft microsoft-identity-web vulnerability
Published Oct 15, 2026
·Updated
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
Other sources
Microsoft Identity Web Elevation of Privilege Vulnerability
— Microsoft
Affected Software
1 affected componentFixes available
Microsoft microsoft-identity-web<3.16.0
3.16.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.16.0
Event History
Oct 15, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Can an unauthenticated attacker exploit this remotely?
No. Exploitation requires an authorized attacker with network access and low privileges; no user interaction is required. The attack complexity is rated high.
2
How mature and reliable is the vulnerability information?
The report confidence is rated confirmed. Exploit code availability is rated unknown, and the remediation level is rated official fix.