The vulnerability resides in Himmelblau’s token validation routine used during the Device Authorization Grant flow. When a user authenticates with valid credentials, the system validates only the domain component of the user principal name, neglecting to compare the username part. This allows a legitimate user within the same Azure Entra ID domain to request a token for any other local account and obtain a local Unix session as that target account, effectively bypassing authentication and gaining unauthorized local privileges. The flaw represents a classic improper authorization error (CWE‑863).

The affected product is Himmelblau IDM from Himmelblau‑IDM. Versions 2.0.0 through before 3.1.5 and 2.3.11 contain the flaw. The fix is available in 3.1.5 and 2.3.11 and later releases.

The CVSS score of 8.4 indicates a high severity of this unauthorized local session takeover. The EPSS score is unavailable, so exploitation likelihood cannot be quantified from an EPSS perspective. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be a legitimate user in the same Entra ID domain and to possess valid credentials; no additional network exposure is required beyond the normal DAG flow. Once the flaw is exploited, the attacker can run arbitrary commands as the impersonated local user and potentially access confidential local data or further pivot within the host.