Skip to content
OpenAdvisories

Vendor

himmelblau-idm

10 known vulnerabilities.

Products

himmelblau 10
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.4
    CVE-2026-45108

    Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

    Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the sam…

    himmelblau-idm himmelblau
  • High 8.8
    CVE-2026-31979

    himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache

    Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, Pr…

    himmelblau-idm himmelblau
  • High 7.1
    CVE-2025-54882

    Himmelblau's Kerberos credential cache collection is world readable

    Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cach…

    himmelblau-idm himmelblau