CyberRota Analysis
AI-GeneratedMicrosoft Azure API Management is vulnerable due to a flaw in its self-service signup process, allowing attackers to exploit the registration flow across different tenants by manipulating the hostname or tenant identifier, even if signup is disabled for the target tenant. This critical vulnerability could lead to unauthorized access and account creation, posing significant risks to organizations utilizing Azure API Management. Enterprises using this service, particularly those with multi-tenant configurations, should prioritize immediate review and remediation of their authentication settings to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation).