Authentication bypass through an alternate path or channel in Microsoft Azure Active Directory B2C permits an unauthorized attacker to elevate privileges over a network, enabling them to access resources or perform actions beyond their authorized scope. This flaw allows the attacker to gain higher-level permissions without proper verification, potentially compromising sensitive data and services.

The vulnerability affects Microsoft Entra (Microsoft Entra ID) services that support alternative authentication channels. No specific product versions are listed, implying that any configuration exposing such alternate paths may be susceptible.

The CVSS score of 9.1 indicates a critical level of severity, and while the EPSS score is not available, the lack of an EPSS value does not diminish the potential impact; the flaw remains exploitable over the network and is not currently listed in the CISA KEV catalog. The attack vector is likely remote, requiring the attacker to access an alternate authentication channel to bypass standard verification checks.