CVE-2026-45108

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45108
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45108.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45108
Aliases
  • GHSA-pmxh-j4r6-88mv
Downstream
Related
Published
2026-05-27T18:53:29.232Z
Modified
2026-08-04T11:31:20.758974827Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow
Details

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45108.json"
}
References

Affected packages

Git / github.com/himmelblau-idm/himmelblau

Affected ranges

Type
GIT
Repo
https://github.com/himmelblau-idm/himmelblau
Events
Introduced
573ccc076f11c5d94eefcb177c466b3abfe6dc51
Fixed
c802b25f5869419541c9316e01b8af87c7acf5c1
Introduced
cf9255c3ffea77705e9725b18f39d520b3b07f59
Fixed
445569d9eae49a6b573365d2740233937d269e39
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.3.11"
        },
        {
            "introduced": "3.0.0-alpha"
        },
        {
            "fixed": "3.1.5"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.1.0
2.2.0
2.3.0
2.3.1
2.3.10
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
3.*
3.0.0
3.0.0-alpha
3.0.0-beta
3.0.0-beta2
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45108.json"