Home / Vulnerability Intelligence / CVE-2026-31957

CVE-2026-31957 - Vulnerability Analysis

CriticalCVSS: 10.0

Last Updated: March 12, 2026

Himmelblau - Authentication Bypass

Published: March 11, 2026Updated: March 12, 2026Remote Exploitable

Overview

Himmelblau 3.0.0 to < 3.1.0 contains a broken authentication caused by lack of tenant domain configuration in himmelblau.conf, letting attackers authenticate with arbitrary Entra ID domains, exploit requires misconfiguration without tenant domain.

Severity & Score

Severity: Critical

CVSS Score: 10.0

EPSS Score: 21.3%(Probability of exploitation in next 30 days)

Impact

Attackers can authenticate as arbitrary Entra ID domains, potentially bypassing tenant restrictions and gaining unauthorized access.

Mitigation

Upgrade to version 3.1.0 or later.

References

https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-q746-m2wv-qh4v

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 12, 2026

⚠️ CRITICAL: CVE-2026-31957 in himmelblau-idm (3.0.0-<3.1.0) lets attackers bypass Azure Entra ID tenant isolation if tenant domain isn't set. Upgrade to 3.1.0+ & enforce config! Details: https://radar.offseq.com/threat/cve-2026-31957-cwe-1188-insecure-default-initializ-e7809765 #OffSeq #Azure #CVE202631957 #InfoSec

View original post

Related Resources

Details

CVE ID: CVE-2026-31957
Severity: Critical
CVSS Score: 10.0
Type: broken_authentication
Status: unconfirmed
EPSS: 21.3%
Social Posts: 1

CWE

CWE-1188

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

21.3%Probability of exploitation in the next 30 days