Weak authentication in Active Directory Federation Services enables an attacker to bypass a security feature over a network, allowing unauthorized authentication and access to AD FS services and potentially the resources those services protect. The flaw is classified as CWE‑1390, indicating a failure to enforce proper authorization checks during authentication.

Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025 (both standard and Server Core installations) with Active Directory Federation Services enabled are impacted. The vulnerability applies to all affected Windows Server releases listed in the CNA supplier vendor and product list.

The CVSS score of 5.9 places this flaw in the moderate severity range. The EPSS score is not available, so the current exploitation probability is unknown, and it is not listed in the CISA KEV catalog. Based on the description and the fact that the flaw is exploitable over a network, the likely attack vector is remote network access to the AD FS service. An attacker with network connectivity to the AD FS endpoint could successfully bypass the security feature and obtain unauthorized authentication rights without requiring local privileges.