Weak authentication in Active Directory Federation Services permits an attacker to bypass a built‑in security feature over a network, potentially undermining the integrity of authentication processes and allowing unauthorized access to protected resources. This flaw is classified as CWE‑1390, indicating unverified credentials are used in an insecure manner.

Microsoft Windows 10 1607 and 1809, Windows Server 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, all of which run the AD FS component that is vulnerable to the flaw.

The CVSS score of 5.9 reflects a moderate severity, but the EPSS score is not available, so the likelihood of exploitation is uncertain; the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation at the time of analysis. The exploit appears to be network‑based, requiring the attacker to communicate with the AD FS service, and does not provide a local privilege escalation or remote code execution capability.