MICROSOFT ENTRA ID FLAW ALLOWED HIJACKING ANY COMPANY'S TENANT

Summary from the TLDR InfoSec newsletter

Security researcher Dirk-jan Mollema found a critical flaw that combined undocumented "actor tokens" from Microsoft's legacy Access Control Service with a bug in the deprecated Azure AD Graph API. This flaw allowed complete takeover of any Microsoft Entra ID tenant with Global Admin rights. The attack exploited unsigned actor tokens that bypass security, generate no audit logs, and stay valid for 24 hours without revocation, letting attackers impersonate users. Microsoft patched the vulnerability CVE-2025-55241 within nine days of disclosure in July. The flaw highlights ongoing risks from legacy authentication systems lacking modern security controls.