PT-2026-40252 · Microsoft · Linux-Entra-Sso

CVE-2026-42177 · Published 2026-05-12 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions linux-entra-sso versions prior to 1.8.1

Description The browser plugin for Linux used for SSO on Microsoft Entra ID contains an issue in the Chrome adapter where a declarativeNetRequest rule uses a urlFilter that performs substring matching against the full request URL. Because the rule lacks a proper anchor, a main-frame navigation to a URL containing "https://login.microsoftonline.com/" in its path can trigger the modifyHeaders action. This causes the browser to attach the Entra ID Primary Refresh Token (PRT) cookie to requests sent to an attacker-controlled host, provided the extension has broad host permissions. This occurs because the Chrome adapter lacks the startsWith() check implemented in the Firefox adapter.

Recommendations Update to version 1.8.1.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-436

Related Identifiers

CVE-2026-42177

GHSA-52RJ-42VH-2RXC

Affected Products

Linux-Entra-Sso

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42177.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-42177 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42177 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42177 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42177 · Security Note
• https://ubuntu.com/security/CVE-2026-42177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42177 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42177 · Vendor Advisory
• https://github.com/siemens/linux-entra-sso/security/advisories/GHSA-52rj-42vh-2rxc · Note
• https://twitter.com/CVEnew/status/2054340997014761534 · Twitter Post