Description<!---->A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth application.&nbsp;This may allow an malicious user to gain complete control of the user's account, including access to private customer data and sensitive information.A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth application. This may allow an malicious user to gain complete control of the user's account, including access to private customer data and sensitive information.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
grafana grafana |
Vulmon