Potential Risk of Privilege Escalation in Azure AD Applications

Summary Summary Microsoft has developed mitigations for an insecure anti-pattern used in Azure AD (AAD) applications highlighted by Descope, and reported to Microsoft, where use of the email claim from access tokens for authorization can lead to an escalation of privilege. An attacker can falsify the email claim in tokens issued to applications.

aad access access tokens applications authorization azure azure ad claim email escalation insecure microsoft mitigations privilege privilege escalation risk tokens