CVE-2024-21632

omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.

• CWE-287

• https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1Patch
• https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvjVendor Advisory
• https://www.descope.com/blog/post/noauthExploit
• https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1Patch
• https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvjVendor Advisory
• https://www.descope.com/blog/post/noauthExploit

Published

Jan 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21630Zulip is an open-source team collaboration tool. A vulnerabi…4.3
• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5
• CVE-2024-21635Memos is a privacy-first, lightweight note-taking service th…7.5
• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1
• CVE-2024-21637Authentik is an open-source Identity Provider. Authentik is …5.4
• CVE-2024-21638Azure IPAM (IP Address Management) is a lightweight solution…9.8