CVE-2026-42602: AzureAuthExtension Fails to Validate JWTs, Allowing Auth Bypass via Host Header Manipulation

Vulnerability Overview Vulnerability Name: method does not validate bearer tokens, allowing authentication bypass via replay Vulnerability ID: CVE-2026-42602 / GHSA-p6v4-3c63-699f Severity: High (CVSS 8.1) Description: The method of does not validate incoming bearer tokens (JWTs). Instead, it retrieves an access token using configured credentials and performs a string equality comparison between the client token and the server token. Since the server token is obtained from the header provided by the client, an attacker can supply a matching header to bypass JWT signature validation. Tokens are replacable throughout their entire lifespan (typically several hours for managed identity tokens). Root Cause: 1. No JWT Validation: Proper Entra ID JWT validation requires verifying the JWT signature and checking the , , , , and allowed algorithms. The extension does not perform this check. 2. Attacker-Controlled Audience: The scope used to generate the "expected" token is derived from the client-supplied header. Azure credentials return cached tokens bound to a (identity, scope) pair. An attacker can guess which tokens have been issued to the Service Principal (SP) and match them by setting the header. This exploits the fact that managed identities are shared among Azure integrations (such as ARM, Graph, Key Vault, and Storage accounts). Impact: Vulnerability Category: Improper Authentication (CWE-287), along with CWE-347 (Improper Verification of Cryptographic Signature), CWE-294 (Authentication Bypass by Capture-replay), and CWE-290 (Authentication Bypass by Spoofing). Threat Model: The attacker must already possess (or be able to obtain) a valid Azure access token issued for the Collector SP. Consequences: Unauthorized injection of arbitrary payloads, metrics, and logs from the Collector's perspective. Downstream impacts depend on the collector exporters, including telemetry backend injection, logging (to mask real attack activities), metric manipulation to trigger or suppress alerts, cost inflation, and malicious telemetry targeting paid backends and advanced analytics services. Affected Versions: >= v0.124.0, <= v0.150.0 Not Affected: Outbound paths (used by Azure exporters) are not affected. Most Susceptible Deployments: Multi-workload Azure environments where the collector shares a managed identity with other workloads. Deployments forwarding the header (via proxies, service meshes, or log pipelines). Multi-tenant environments where telemetry from different customers converges on a collector protected by this extension. Remediation Mitigation: Before a patched version is available, remove from any receiver . For OTLP receivers that require Entra ID JWT validation, use , which has a fixed audience defined in the configuration. Configuration Example (oidcauthextension): POC Code Vulnerable Code Snippet (extension.go:288-295): Vulnerable Code Snippet (extension.go:187-206): Proof of Concept - Variant A (Replay same scope): Proof of Concept - Variant B (Scope confusion):

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-42602: AzureAuthExtension Fails to Validate JWTs, Allowing Auth Bypass via Host Header Manipulation

More from this source