ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability
Published Sep 9, 2026
·Updated
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.8.
Affected Software
1 affected component
Microsoft Azure Entra ID
Event History
Sep 9, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Does exploiting this issue require authentication?
No. The vulnerability can be exploited remotely without authentication.
2
What is the reported impact of a successful exploit?
A successful exploit may disclose sensitive information from affected Microsoft Azure Entra ID installations.
3
How severe is the vulnerability according to the available advisory data?
The ZDI assigned this issue a CVSS score of 5.8, and the supplied risk value is 48.