AUTHENTICATION DOWNGRADE ATTACKS: DEEP DIVE INTO MFA BYPASS

Summary from the TLDR InfoSec newsletter

IOActive demonstrated an authentication downgrade attack using Cloudflare Workers as a transparent reverse proxy to intercept Microsoft Entra ID login flows, modifying the JSON configuration and injecting CSS to hide FIDO2/WebAuthn options and force victims to fall back to phishable MFA methods, such as push notifications. The technique leverages trusted CDN infrastructure with valid TLS certificates and zero forensic footprint, enabling session token capture (ESTSAUTH cookies) while authentication logs appear completely legitimate. Organizations with "mixed mode" MFA policies should enforce FIDO2-only Conditional Access rules without fallback methods and alert when users unexpectedly switch from hardware keys to weaker authentication factors.