VYPR
← All advisories
Critical severity10.0NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-31957

CVE-2026-31957

Description

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not tenant-scoped. In this mode, Himmelblau can accept authentication attempts for arbitrary Entra ID domains by dynamically registering providers at runtime. This behavior is intended for initial/local bootstrap scenarios, but it can create risk in remote authentication environments. This vulnerability is fixed in 3.1.0.

Affected products

3
  • Himmelblau Idm/Himmelblauv53 versions
    >= 3.0.0, < 3.1.0+ 2 more
    • (no CPE)range: >= 3.0.0, < 3.1.0
    • (no CPE)range: 3.0.0 <= v < 3.1.0
    • cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*range: <3.1.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.