Skip to content
OpenAdvisories
High MSRC-CVE-2026-80092 1 CVE

Microsoft Identity Web Elevation of Privilege Vulnerability

Published Oct 15, 2026 · Updated Oct 19, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could an attacker gain by exploiting this vulnerability?
An attacker could obtain another user's access token and access resources permitted by that token. The accessible resources depend on the permissions granted to the affected user's token.

What conditions are required to exploit this vulnerability?
Successful exploitation requires the application to use a shared token cache and the targeted user to have an active token in that cache.

Security updates
4.16.1 — https://github.com/AzureAD/microsoft-identity-web/blob/master/changelog.md
3.16.0 — https://github.com/AzureAD/microsoft-identity-web/blob/rel/3v/changelog.md

Vulnerabilities 1

  • Medium 5.3
    CVE-2026-80092

    Microsoft Identity Web Elevation of Privilege Vulnerability

    Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.

    Microsoft microsoft-identity-web

Revision history

  1. #2

    Updated the Security Updates table to list Microsoft Identity Web v3 and v4 separately and clarify the affected version ranges. The existing security updates are versions 3.16.0 and 4.16.1, respectively. This is an informational change only.

  2. #1

    Information published.

References