The vulnerability is an origin validation error in Microsoft Entra ID that permits an attacker who is not authorized to gain elevated privileges over a network. Because the origin of requests is not properly verified, an attacker can masquerade as a legitimate user or service and gain unauthorized administrative access. This leads to complete control over the Entra ID tenant, allowing the attacker to create or modify identities, delete objects, or alter policy settings.

This flaw affects Microsoft Entra ID, the cloud identity platform provided by Microsoft. All versions that include the affected component, as identified by the CNA, are impacted; specific version details were not disclosed in the advisory, so organizations should verify whether they are running the product version that is known to be vulnerable.

The CVSS score of 10 indicates a critical severity. No EPSS score is presented, so the probability of exploitation is not quantified, but the lack of an available exploit score does not diminish the risk because the vulnerability allows direct privilege escalation. The vendor has not listed this issue in the CISA KEV catalog. The likely attack vector is remote, network‑based; an attacker would need to send a crafted request that bypasses origin verification to the Entra ID endpoint. Because the flaw is in origin validation, any network path that can reach the service can be used.