CVE-2026-33843

The vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) allows an attacker to gain access to a resource or system functionality by bypassing the standard authentication mechanism through an alternative path or channel. The attack can be conducted remotely over the network without requiring any prior privileges or victim engagement. Exploitation of the vulnerability allows the attacker to escalate privileges in the Azure Active Directory B2C environment.

An unauthorized attacker can obtain elevated privileges in the Azure Active Directory B2C environment, which may result in unauthorized access to protected resources and compromise of data confidentiality and integrity (high impact on C and I according to CVSS vector).

Apply patches available from the vendor according to the references — detailed information about available fixes can be found in the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33843

Microsoft Azure Active Directory B2C — versions indicated in the vendor references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33843)