The vulnerability arises from the use of client‑side authentication in Skype for Business. An attacker who is already authorized and can observe or influence the communication channel could spoof authentication credentials, impersonating another user or service. This flaw belongs to CWE-603, Implicit Authentication, and it allows an attacker to bypass proper identity verification and potentially gain unauthorized access to voice, video or contact information.

Microsoft's Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1 are affected. Any instances of these products that have not been updated beyond the listed cumulative updates are susceptible to the spoofing attack.

The CVSS base score is 7.1, indicating a high severity level. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authorized user with network access or a compromised network path; the attacker would need to interact with the client application to inject or modify authentication tokens. The lack of a public exploitation indicator suggests that exploitation is plausible but has not been observed in the wild.