Full Report
Invisible password sprays. Invisible logins. Full tokens returned.Nyxgeek here. It's 2026 and I've got two more Azure Entra ID sign-in log bypasses to share with you. Don't get too excited…these bypasses…
Analysis Summary
# Vulnerability: Azure Entra ID Sign-In Log Bypass (GraphGoblin & Graph******)
## CVE Details
- **CVE ID**: Not Assigned (Microsoft declined to issue a CVE, categorizing it as a sub-feature flaw rather than a direct security boundary breach).
- **CVSS Score**: N/A (Historically, similar flaws were rated **Important** by Microsoft but later downgraded).
- **CWE**: CWE-778: Insufficient Logging.
## Affected Systems
- **Products**: Microsoft Azure / Entra ID.
- **Versions**: Cloud-based (All versions prior to March 2026 fix).
- **Configurations**: Default configurations using Entra ID for authentication.
## Vulnerability Description
The researcher "Nyxgeek" identified two new methods (dubbed **GraphGoblin** and **Graph******) to authenticate against Azure endpoints without the activity being recorded in the Entra ID sign-in logs. Unlike previous bypasses that only allowed for password validation (silent sprays), these flaws allowed an attacker to retrieve **fully functioning authentication tokens**.
The bypass was achieved by sending specially crafted login attempts to specific internal or "first-party" Microsoft authentication endpoints that bypassed the standard logging pipeline. This effectively rendered "invisible" any password spraying or successful unauthorized logins, as they would not appear in the tenant’s Sign-in logs or be ingested by connected SIEMs.
## Exploitation
- **Status**: PoC available (Authored by researcher); Fixed by vendor as of March 2026.
- **Complexity**: Low (Discovered via simple fuzzing of authentication endpoints).
- **Attack Vector**: Network.
## Impact
- **Confidentiality**: High (Allows unauthorized access to valid tokens and data without detection).
- **Integrity**: Low (Standard user permissions apply to the retrieved tokens).
- **Availability**: None.
## Remediation
### Patches
- **Vendor Action**: Microsoft has implemented server-side fixes to ensure these specific authentication paths are now logged or restricted. No admin action is required for the "patch" as it is a SaaS platform.
### Workarounds
- There are no direct workarounds to force logging on these specific legacy/internal endpoints; infrastructure-level fixes by Microsoft were required.
## Detection
The researcher suggests using **KQL (Kusto Query Language)** to identify "silent" anomalies that might indicate a log bypass or an attempt to use tokens that lack a corresponding sign-in event.
- **Indicators of Compromise**:
- Discrepancies between `AADServicePrincipalSignInLogs` and `SigninLogs`.
- Presence of authentication tokens being used for Graph API calls without a preceding interactive or non-interactive login log entry for that specific Correlation ID.
- **Detection Method**: Monitor for "OfficeHome" or first-party Microsoft application IDs appearing in resource access logs without associated entry-point logs.
## References
- **Vendor Advisory**: MSRC (Case closed without public CVE).
- **Relevant Links**:
- hxxps[://]trustedsec[.]com/blog/full-disclosure-a-third-and-fourth-azure-sign-in-log-bypass-found
- hxxps[://]github[.]com/nyxgeek (Tools: GraphNinja, GraphGhost)