Microsoft Azure API Management prior 2025-10-17 API endpoint access control ⚔ [Disputed]

Summaryinfo

A vulnerability classified as critical was found in Microsoft Azure API Management. Affected by this issue is some unknown functionality of the component API endpoint. The manipulation results in access control. This vulnerability was named CVE-2025-66390. The attack may be performed from remote. There is no available exploit. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft Azure API Management. Affected is an unknown function of the component API endpoint. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation).

The advisory is available at github.com. This vulnerability is traded as CVE-2025-66390 since 11/28/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/21/2026). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The real existence of this vulnerability is still doubted at the moment.

Upgrading to version 2025-10-17 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Cloud Software

Vendor

• Microsoft

Name

• Azure API Management

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion