{"id":"CVE-2026-45108","aliases":["EUVD-2026-32633","GHSA-pmxh-j4r6-88mv","SUSE-SU-2026:22186-1","openSUSE-SU-2026:21111-1"],"status":"published","title":"Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00246,"percentile":0.1595,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-05-27T18:53:29Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"himmelblau","fixed_in":["2.3.11+git1.116c6763-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"himmelblau","fixed_in":["2.3.11+git1.116c6763-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"himmelblau","fixed_in":["2.3.11+git1.116c6763-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.11+git1.116c6763-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.11+git1.116c6763-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.11+git1.116c6763-160000.1.1"}]}]}],"products":[{"vendor":"himmelblau-idm","product":"himmelblau"}],"references":[{"url":"https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-pmxh-j4r6-88mv","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45108.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45108","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622186-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266662","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45108","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45108","title":"Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.","status":"published","published":"2026-05-27T18:53:29.232Z","modified":"2026-05-28T13:54:57.795Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-32633","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.","status":"published","published":"2026-05-27T18:53:29Z","modified":"2026-05-28T13:54:57Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:21:02.581093Z"}],"nvd":[{"id":"CVE-2026-45108","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.","status":"published","published":"2026-05-27T20:16:38.55Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-45108","title":"Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.","status":"published","published":"2026-05-27T18:53:29.232Z","modified":"2026-10-28T02:30:49.053297579Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"openSUSE-SU-2026:21111-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issue\n\n- CVE-2026-45108: authentication bypass vulnerability in the Device Authorization Grant (DAG) flow (bsc#1266662).\n\nChanges for himmelblau:\n\n- Update to version 2.3.11+git1.116c6763:\n\n * Update cargo vet audits for backport\n * deps(rust): bump the all-cargo-updates group with 19 updates\n\n- Update to version 2.3.10:\n\n * nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau\n * selinux: allow unconfined_service_t to search himmelblaud_t dirs\n","status":"published","published":"2026-06-19T17:10:10Z","modified":"2026-06-30T18:24:41.977502381Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22186-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issue\n\n- CVE-2026-45108: authentication bypass vulnerability in the Device Authorization Grant (DAG) flow (bsc#1266662).\n\nChanges for himmelblau:\n\n- Update to version 2.3.11+git1.116c6763:\n\n * Update cargo vet audits for backport\n * deps(rust): bump the all-cargo-updates group with 19 updates\n\n- Update to version 2.3.10:\n\n * nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau\n * selinux: allow unconfined_service_t to search himmelblaud_t dirs\n","status":"published","published":"2026-06-19T17:04:12Z","modified":"2026-06-24T18:24:19.464127522Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}