Off-topic for aiqbench

This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.

Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users

Cybersecurity NewsOctober 2, 20264 min read

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform. The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept a forged identity after the normal sign-in controls had been bypassed. The affected platform used […] The post Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users appeared first on Cyber Security News.

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform. The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept a forged identity after the normal sign-in controls had been bypassed. The affected platform used Entra ID single sign-on and multi-factor authentication, but also relied on a signed cookie to maintain…

Excerpt shown under the publisher's RSS terms · 71 words · full text and figures are on the publisher's site

Read at Cybersecurity News ↗Ask about this article