Prior to version 1.8.1 the linux-entra-sso browser extension registers a Chrome declarativeNetRequest rule that appends the Entra ID Primary Refresh Token cookie to any request whose URL matches the substring "login.microsoftonline.com". Because the rule performs a substring match and the extension declares broad host permissions ("https://*/*"), a navigation to any page that contains that substring in its path causes the PRT cookie to be sent to an attacker‑controlled host. This leakage allows an attacker who can host a malicious web page to retrieve the cookie and potentially hijack the user’s SSO session, gaining unauthorized access to the Microsoft Entra environment.

The vulnerability affects the Siemens linux-entra-sso browser plugin for Linux, specifically versions prior to 1.8.1. The plugin must be installed with the optional host permissions "https://*/*" and runs on Chromium‑based browsers that support declarativeNetRequest.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not provided and the vulnerability is not listed in CISA's KEV catalog, suggesting a lower likelihood of active exploitation. However, the attack surface exists when a user with the extension visits or interacts with a website that embeds the login.microsoftonline.com path; the attacker only needs to host a page that triggers the browser’s request to that path. Exploitation requires user interaction and the presence of the vulnerable plugin, but once the cookie is transmitted it can be used for session hijack and privileged operations within the Entra ID tenant.