Azure Active Directory Security Feature Bypass Vulnerability

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker can bypass Windows Trusted Platform Module by crafting an assertion and using the assertion to request a Primary Refresh Token from another device.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
An attacker would require access to a low privileged session on the user's device to obtain a JWT (JSON Web Token) which can then be used to craft a long-lived assertion using the Windows Hello for Business Key from the victim's device.

According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of integrity (I:H)? What does that mean for this vulnerability?
By exploiting this vulnerability, an attacker can craft a long-lived assertion and impersonate a victim user affecting the integrity of the assertion.

What actions do I need to take to be protected from this vulnerability?
Customers should install Windows updates released on or after July 11, 2023 on client devices with Windows OS. Please refer the affected software section to apply the update.

What actions do I need to take to be protected from this vulnerability?
To be protected, apply the fix as follows:
Install Windows updates released on or after July 11, 2023 on all AD FS servers of the farm. Then, enable the setting by running the following PowerShell command on the primary AD FS server of the farm:
Set-AdfsProperties-EnforceNonceInJWT Enabled

Security updates
10.0.17763.4645 — https://support.microsoft.com/help/5028168
10.0.20348.1850 — https://support.microsoft.com/help/5028171
10.0.22000.2176 — https://support.microsoft.com/help/5028182
10.0.19044.3208 — https://support.microsoft.com/help/5028166
10.0.22621.1992 — https://support.microsoft.com/help/5028185
10.0.10240.20048 — https://support.microsoft.com/help/5028186
10.0.14393.6085 — https://support.microsoft.com/help/5028169