Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-56425

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing them in OAuth redirect URLs could leak valid session tokens through browser history, HTTP Referer heade
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:60573fb3dc949994049ff325cc74d4daa76df12bcc5521cc1845fbac220eeae8
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"misp","repo":"https://github.com/misp/misp","vendor":"misp","versions":[{"lessThanOrEqual":"2.5.41","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:3eb2a733ca963e6c60e9fd7b1d68e901e025bae596122f8d318b0e92926a9f3c · sha256:0a8d17225b438369… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact"…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:3eb2a733ca963e6c60e9fd7b1d68e901e025bae596122f8d318b0e92926a9f3c · sha256:0a8d17225b438369… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-384","description":"CWE-384 Session Fixation","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:3eb2a733ca963e6c60e9fd7b1d68e901e025bae596122f8d318b0e92926a9f3c · sha256:0a8d17225b438369… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"tags":["patch"],"url":"https://github.com/MISP/MISP/commit/146bc40ad6e10a44f01e8ed62d5f7bc9c06cc4fa"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3eb2a733ca963e6c60e9fd7b1d68e901e025bae596122f8d318b0e92926a9f3c · sha256:0a8d17225b438369… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer