PT-2026-24804 · Git+1 · Himmelblau

Khronosd · Published 2026-03-11 · Updated 2026-03-16 · CVE-2026-31957

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Himmelblau versions 3.0.0 through 3.1.0

Description Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. If Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not limited to the intended tenant. In this scenario, Himmelblau can accept authentication attempts from any Entra ID domain through dynamic provider registration during runtime. This behavior is designed for initial or local setup but introduces risk in remote authentication environments. This can lead to tenant confusion attacks, potentially granting initial access.

Recommendations Versions 3.0.0 through 3.1.0 should be updated to version 3.1.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-31957

GHSA-Q746-M2WV-QH4V

Affected Products

Himmelblau

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31957.json · Exploit
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-q746-m2wv-qh4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31957 · Security Note
• https://twitter.com/CVEnew/status/2031867679099740219 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031817235354804286 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031869658890960929 · Twitter Post
• https://twitter.com/CveFindCom/status/2031833015303762278 · Twitter Post
• https://t.me/cveNotify/155550 · Telegram Post