CVE-2016-7191

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-7191
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7191.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-7191
Aliases
Published
2016-09-28T20:59:00.240Z
Modified
2026-07-08T10:53:43.990562Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

References

Affected packages

Git / github.com/azuread/passport-azure-ad

Affected ranges

Type
GIT
Repo
https://github.com/azuread/passport-azure-ad
Events
Introduced
6deb0df82bfe93ba2e628ece351c0db94aaddfce
Last affected
f4afd5b006752d989bd421ce47512cd720b43728
Database specific 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.3.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:1.4.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:microsoft:azure_active_directory_passport:2.0.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "1.1.1"
        },
        {
            "last_affected": "1.1.1"
        },
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.2.0"
        },
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.3.0"
        },
        {
            "introduced": "1.3.1"
        },
        {
            "last_affected": "1.3.1"
        },
        {
            "introduced": "1.3.2"
        },
        {
            "last_affected": "1.3.2"
        },
        {
            "introduced": "1.3.3"
        },
        {
            "last_affected": "1.3.3"
        },
        {
            "introduced": "1.3.4"
        },
        {
            "last_affected": "1.3.4"
        },
        {
            "introduced": "1.3.5"
        },
        {
            "last_affected": "1.3.5"
        },
        {
            "introduced": "1.3.6"
        },
        {
            "last_affected": "1.3.6"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        },
        {
            "introduced": "1.4.2"
        },
        {
            "last_affected": "1.4.2"
        },
        {
            "introduced": "1.4.3"
        },
        {
            "last_affected": "1.4.3"
        },
        {
            "introduced": "1.4.4"
        },
        {
            "last_affected": "1.4.4"
        },
        {
            "introduced": "1.4.5"
        },
        {
            "last_affected": "1.4.5"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
2.*
2.0.0
v1.*
v1.0.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7191.json"