CVE-2016-7191
Authentication Bypass in passport-azure-ad
CVE-2016-7191 is a high vulnerability (CVSS 8.1) in Microsoft Azure Active Directory Passport, published September 28, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 29.4%, the 98th percentile. Fixed in passport-azure-ad 1.4.6.
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
- Record
CVE-2016-7191- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
- Record
CVE-2016-7191- Updated
- 2026-11-02
EUVDEUVD-2018-0239 No score
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
- Record
EUVD-2018-0239- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-73jp-3c67-hjfv
Authentication Bypass in passport-azure-ad
Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Recommendation
Version 1.x: Update to version 1.4.6 or later. Version 2.x: Update to version 2.0.1 or later.
- Record
GHSA-73jp-3c67-hjfv- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
- Record
CVE-2016-7191- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-73jp-3c67-hjfv
Authentication Bypass in passport-azure-ad
Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Recommendation
Version 1.x: Update to version 1.4.6 or later. Version 2.x: Update to version 2.0.1 or later.
- Record
GHSA-73jp-3c67-hjfv- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
passport-azure-adnpm |
1.0.0 up to 1.4.6 | 1.4.6 |
passport-azure-adnpm |
2.0.0 to 2.0.0 | 2.0.1 |
passport-azure-adnpm |
2.0.0 up to 2.0.1 | 2.0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/AzureAD/passport-azure-ad/blob/master/SECURITY-NOTICE.MD
securitytracker.com/id/1036996
support.microsoft.com/kb/3187742
securityfocus.com/bid/93213
nvd.nist.gov/vuln/detail/CVE-2016-7191
npmjs.com/advisories/151