Microsoft Identity Web contains an authentication bypass that arises from data assumed immutable. An attacker who already holds valid credentials can exploit this flaw to elevate privileges across the network. The weakness is categorized as CWE-302, indicating a failure to enforce proper authentication or authorization controls. The result is a direct compromise of account privileges, potentially leading to further exploitation of connected applications.

Microsoft Identity Web is impacted. No specific version information is provided in the CVE data, so all releases of the product should be considered vulnerable until an official fix is confirmed.

The CVSS score of 5.3 suggests a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time. It is inferred that exploitation requires authenticated access and occurs over the network when an attacker submits requests that assume the data is immutable. The attack vector is therefore likely network-based authentication bypass.