Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.
Should have been addressed in the Geneva conventions.
by xmcp123 - >> The original RuntimeUrl path was no longer validated, and as a result, you could perform that attack again. I would include some pictures, but they would be the same pictures as above, so you can just imagine them.
Such kindness & grace shown by the author. He/she could have ripped azure furthermore so easily.
by sam1r - path traversal and IDOR..
likely been active since the inception of these capabilities
wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
by thewisenerd - Ok so.
Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).
Vulnerability was reported.
They fixed it - incorrectly. Reported again.
They fixed it this time... and broke the previous fix. So it's vulnerable again.
What a clown show.
by outworlder - This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!by giovanni_or2
- maybe we should tag submissions with dates now?
[2026-10-02]
beginning of curent month feels like two years ago when multiple vulns drop daily
by albert_e - When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.by meekins
- If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?
The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
by unddoch