CVE-2025-66390 Analysis: Azure APIM Cross-Tenant Registration Bypass

Azure API Management (APIM) Cross-Tenant Registration Bypass Vulnerability Summary Vulnerability Overview Vulnerability Name: Azure API Management (APIM) Cross-Tenant Registration Bypass CVE ID: CVE-2025-66390 Status: The vulnerability is still active and exploitable. Microsoft has not patched this issue and considers it "by design." Description: In the Azure API Management (APIM) Developer Portal, attackers can still create accounts by bypassing UI restrictions, even if administrators have disabled user registration. This can lead to unauthorized access to API documentation, subscription keys, and other resources exposed through the Developer Portal. Scope of Impact Affected Configurations: - APIM instances with Basic Authentication enabled - Developer Portal is deployed and accessible - Non-Consumption tier (the Consumption tier restricts portal features) Unaffected Configurations: - Basic Authentication identity provider completely removed - Only Azure AD / OAuth authentication configured - Developer Portal is not deployed or is disabled Remediation Key Takeaway: Disabling the registration feature in the Azure Portal UI is insufficient to prevent cross-tenant registration bypasses. The Basic Authentication identity provider must be completely removed to prevent such bypasses. Identifying Vulnerable APIM Instances: - Use Azure Resource Graph, ARM templates, or Azure Policy to check the following properties: - is set to - is a non-Consumption tier - A identity provider resource exists - is set to (coexisting with Basic Auth) Proof of Concept (POC) Additional Information Disclosure Timeline: - 2025-09-30: Vulnerability discovered - 2025-09-30: First report submitted to MSRC - 2025-10-30: MSRC response: "Not a vulnerability" - 2025-11-01: Second report submitted to MSRC with additional details - 2025-11-20: MSRC response again: "By design" - 2025-11-20: Report submitted to CERT-FI - 2025-11-26: Public disclosure - 2025-11-27: CVE request submitted to MITRE - 2026-07-09: CVE-2025-66390 assigned by MITRE TL-Roof/CNA-LR Identifying APIM Instances Within Your Organization Google Dorks: - - - - - - - - - Shodan: - - - Nuclei Mass Scan: Azure CLI: Verification Script: Nuclei for Internal Security Audits: The above summary covers the key information of the vulnerability, scope of impact, remediation steps, as well as related exploitation code and identification methods.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-66390 Analysis: Azure APIM Cross-Tenant Registration Bypass

More from this source