The Azure SDK for Java contains an improper authentication flaw that allows an unauthorized attacker to bypass a security feature over a network. This vulnerability can enable unauthorized access to resources that should require proper authentication, potentially exposing sensitive data or allowing unintended actions. The flaw maps to CWE-287 (Improper Authentication) and CWE-347 (Missing Authentication for Critical Function).

Microsoft Azure SDK for Java. No specific version information is provided in the advisory, so all existing versions of the SDK may be vulnerable until patched.

The CVSS score of 9.1 classifies this flaw as critical, indicating a high potential impact. The EPSS score is not available, which suggests that the probability of exploitation has not been quantified, but the lack of KEV listing and no public exploits at the time of this advisory mean that attackers would need to develop or obtain a custom exploit. The likely attack vector is over a network, with an unauthorized agent sending crafted requests to the SDK endpoint to force the security feature to be bypassed.