CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs. Starting in version 0.9.0, Himmelblau introduced support for specifying group names in the `pam_allow_groups` configuration option. However, Microsoft Entra ID permits the creation of multiple groups with the same `displayName` via the Microsoft Graph API—even by non-admin users, depending on tenant settings. As a result, a user could create a personal group with the same name as a legitimate access group (e.g., `"Allow-Linux-Login"`), add themselves to it, and be granted authentication or `sudo` rights by Himmelblau. Because affected Himmelblau versions compare group names by either `displayName` or by the immutable `objectId`, this allows bypassing access control mechanisms intended to restrict login to members of official, centrally-managed groups. This issue is fixed in Himmelblau version **0.9.15** and later. In these versions, group name matching in `pam_allow_groups` has been deprecated and removed, and only group `objectId`s (GUIDs) may be specified for secure group-based filtering. To mitigate the issue without upgrading, replace all entries in `pam_allow_groups` with the objectId of the target Entra ID group(s) and/or audit your tenant for groups with duplicate display names using the Microsoft Graph API.

• CWE-287

• https://github.com/himmelblau-idm/himmelblau/commit/918577f6a8392a71d9d3d67f20962c372a0c01c6
• https://github.com/himmelblau-idm/himmelblau/issues/554
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7
• https://learn.microsoft.com/en-us/answers/questions/1035045/azure-ad-b2c-creates-groups-with-the-same-name-usi?utm_source=chatgpt.com

Published

Jun 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49007Rack is a modular Ruby web server interface. Starting in ver…5.3
• CVE-2025-49008Atheos is a self-hosted browser-based cloud integrated devel…9.4
• CVE-2025-49009Para is a multitenant backend server/framework for object pe…6.2
• CVE-2025-4901A vulnerability classified as problematic was found in D-Lin…6.5
• CVE-2025-49010OpenSC is an open source smart card tools and middleware. Pr…6.8
• CVE-2025-49011SpiceDB is an open source database for storing and querying …5.3
• CVE-2025-49013WilderForge is a Wildermyth coremodding API. A critical vuln…9.9
• CVE-2025-49014jq is a command-line JSON processor. In version 1.8.0 a heap…5.5
• CVE-2025-49015The Couchbase .NET SDK (client library) before 3.7.1 does no…4.9
• CVE-2025-4902A vulnerability, which was classified as problematic, has be…7.5
• CVE-2025-49028Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail…7.1
• CVE-2025-49029Improper Control of Generation of Code ('Code Injection') vu…9.1