Researcher Bags $200,000 Breaking Azure API Connections Across Tenants
Azure's Weakest Link – Five Full Cross-Tenant Compromises
A security researcher found five more ways to fully compromise other tenants' Azure API Connections, the Logic Apps component that swaps your token for a backend service's credentials. By abusing undocumented DynamicInvoke endpoints, path traversal, and a host.api.RuntimeUrl parameter, an attacker can read Key Vault secrets or run SQL queries against any victim's connected backend. Microsoft's fixes kept getting bypassed; the bugs earned $200,000 in bounties.
The only thing stopping exploitation is really the layers of input validation bolted onto the various systems, but as you will see, it is really difficult to catch all the edge cases here.
- unddoch
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?
The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
- meekins
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
- giovanni_or2
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
- albert_e
maybe we should tag submissions with dates now?
[2026-10-02]
beginning of curent month feels like two years ago when multiple vulns drop daily
- thewisenerd
path traversal and IDOR..
likely been active since the inception of these capabilities
wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)