CVE-2016-7191

Published: Sep 28, 2016Modified: May 6, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

Affected (18)

Products: Microsoft: Azure Active Directory Passport

Microsoft

1 product

Azure Active Directory Passport

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Microsoft Azure Active Directory Passport	Version 1.0.0
Microsoft Azure Active Directory Passport	Version 1.1.0
Microsoft Azure Active Directory Passport	Version 1.1.1
Microsoft Azure Active Directory Passport	Version 1.2.0
Microsoft Azure Active Directory Passport	Version 1.3.0
Microsoft Azure Active Directory Passport	Version 1.3.1
Microsoft Azure Active Directory Passport	Version 1.3.2
Microsoft Azure Active Directory Passport	Version 1.3.3
Microsoft Azure Active Directory Passport	Version 1.3.4
Microsoft Azure Active Directory Passport	Version 1.3.5
Microsoft Azure Active Directory Passport	Version 1.3.6
Microsoft Azure Active Directory Passport	Version 1.4.0
Microsoft Azure Active Directory Passport	Version 1.4.1
Microsoft Azure Active Directory Passport	Version 1.4.2
Microsoft Azure Active Directory Passport	Version 1.4.3
Microsoft Azure Active Directory Passport	Version 1.4.4
Microsoft Azure Active Directory Passport	Version 1.4.5
Microsoft Azure Active Directory Passport	Version 2.0.0