Azure Devops Zero-Click CI/CD Vulnerability

The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets. The vulnerability does not require any action from the project maintainer, making it a zero-click supply chain vulnerability.

access action appsec attack attackers azure click code devops found legit legit security maintainer making malicious project research scms secrets security security research supply supply chain supply chain vulnerability team threats vulnerability zero-click