PT-2026-40252 · Microsoft · Linux-Entra-Sso

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-42177

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions linux-entra-sso versions prior to 1.8.1

Description The browser plugin for Linux used for SSO on Microsoft Entra ID contains an issue in the Chrome adapter where a declarativeNetRequest rule uses a urlFilter that performs substring matching against the full request URL. Because the rule lacks a proper anchor, a main-frame navigation to a URL containing "https://login.microsoftonline.com/" in its path can trigger the modifyHeaders action. This causes the browser to attach the Entra ID Primary Refresh Token (PRT) cookie to requests sent to an attacker-controlled host, provided the extension has broad host permissions. This occurs because the Chrome adapter lacks the startsWith() check implemented in the Firefox adapter.

Recommendations Update to version 1.8.1.

Fix

Improper Access Control

Weakness Enumeration

CWE-436

CWE-284

Related Identifiers

CVE-2026-42177

Affected Products

Linux-Entra-Sso

References · 8

• https://security-tracker.debian.org/tracker/CVE-2026-42177 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42177 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42177 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42177 · Security Note
• https://github.com/siemens/linux-entra-sso/security/advisories/GHSA-52rj-42vh-2rxc · Note
• https://twitter.com/CVEnew/status/2054340997014761534 · Twitter Post