Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform. The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept a forged identity after the normal sign-in controls had been bypassed. The affected platform used Entra ID single sign-on and multi-factor authentication, but also relied on a signed cookie to maintain application sessions. That design created the same risk seen in cookie-based account takeover attacks, where control of a trusted session can matter more than a password. Resecurity said in a report shared with Cyber Security News (CSN) that its authorized assessment...

Read the full article at the source.