CVE-2026-33843
published 2026-05-22CVE-2026-33843: Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.47%
37.4th percentile
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_entra | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvelistv5v3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5gj2-5693-p684: Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges
ghsa_unreviewed·2026-05-26
CVE-2026-33843 [CRITICAL] CWE-288 GHSA-5gj2-5693-p684: Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
VulDB
Microsoft Entra Active Directory authentication bypass
vuldb·2026-05-23
CVE-2026-33843 [CRITICAL] Microsoft Entra Active Directory authentication bypass
A vulnerability labeled as critical has been found in Microsoft Entra. The impacted element is an unknown function of the component Active Directory Handler. Executing a manipulation can lead to authentication bypass using alternate channel.
The identification of this vulnerability is CVE-2026-33843. The attack may be launched remotely. There is no exploit available.
This product is a managed service. This means that users are not able to maintain vulnerability countermeasures themselves.
CVEList
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
cvelistv5·2026-05-22·CVSS 9.1
CVE-2026-33843 [CRITICAL] CWE-288 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-22
Published