Every CVE Search/ Get API key

CVE-2026-45108

Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

8.4 HighFix available

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.25%Up 0.2 points since May 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.4

Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Record
CVE-2026-45108
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-32633 8.4

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Record
EUVD-2026-32633
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
NVD 8.4

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Record
CVE-2026-45108
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
OSV 8.4

Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Record
CVE-2026-45108
CVSS 3.1
8.4 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
OSVopenSUSE-SU-2026:21111-1 No score

Security update for himmelblau

This update for himmelblau fixes the following issue

  • CVE-2026-45108: authentication bypass vulnerability in the Device Authorization Grant (DAG) flow (bsc#1266662).

Changes for himmelblau:

  • Update to version 2.3.11+git1.116c6763:
  • Update cargo vet audits for backport
  • deps(rust): bump the all-cargo-updates group with 19 updates
  • Update to version 2.3.10:
  • nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau
  • selinux: allow unconfined_service_t to search himmelblaud_t dirs
Record
openSUSE-SU-2026:21111-1
Updated
2026-11-02
OSVSUSE-SU-2026:22186-1 No score

Security update for himmelblau

This update for himmelblau fixes the following issue

  • CVE-2026-45108: authentication bypass vulnerability in the Device Authorization Grant (DAG) flow (bsc#1266662).

Changes for himmelblau:

  • Update to version 2.3.11+git1.116c6763:
  • Update cargo vet audits for backport
  • deps(rust): bump the all-cargo-updates group with 19 updates
  • Update to version 2.3.10:
  • nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau
  • selinux: allow unconfined_service_t to search himmelblaud_t dirs
Record
SUSE-SU-2026:22186-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
himmelblau
SUSE:Linux Enterprise Server 16.0
 before 2.3.11+git1.116c6763-160000.1.1
2.3.11+git1.116c6763-160000.1.1
himmelblau
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.3.11+git1.116c6763-160000.1.1
2.3.11+git1.116c6763-160000.1.1
himmelblau
openSUSE:Leap 16.0
 before 2.3.11+git1.116c6763-160000.1.1
2.3.11+git1.116c6763-160000.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45108 is a high vulnerability (CVSS 8.4) in Himmelblau-idm Himmelblau, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. Fixed in himmelblau 2.3.11+git1.116c6763-160000.1.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open