{"id":"CVE-2024-35255","aliases":["GHSA-m5vv-6r4h-3vj9","GO-2024-2918","PYSEC-2026-1209"],"title":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","summary":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"azure-identity","product":"azure-identity","ecosystem":"pip","affected":["azure-identity < 1.16.1","@azure/identity < 4.2.1","com.azure:azure-identity < 1.12.2","@azure/msal-node >= 2.7.0, < 2.9.2","Microsoft.Identity.Client >= 4.49.1, < 4.60.4","github.com/Azure/azure-sdk-for-go/sdk/azidentity < 1.6.0-beta.4.0.20240610221955-50774cd97099","com.microsoft.azure:msal4j >= 1.14.4-beta, < 1.15.1","Azure.Identity < 1.11.4","Microsoft.Identity.Client >= 4.61.0, < 4.61.3"],"patched":["azure-identity 1.16.1","@azure/identity 4.2.1","com.azure:azure-identity 1.12.2","@azure/msal-node 2.9.2","Microsoft.Identity.Client 4.60.4","github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0-beta.4.0.20240610221955-50774cd97099","com.microsoft.azure:msal4j 1.15.1","Azure.Identity 1.11.4","Microsoft.Identity.Client 4.61.3"],"published":"2024-06-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:17.839035905Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m5vv-6r4h-3vj9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35255"},{"url":"https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"},{"url":"https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"},{"url":"https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d"},{"url":"https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492"},{"url":"https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53"},{"url":"https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"}],"tags":["osv","pip"],"epss":0.0083,"epssPercentile":0.56012,"ingestedAt":"2026-07-08T18:25:51.137Z","slug":"CVE-2024-35255","body":"## Overview\n\nAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.\n\n## Affected packages\n\n- `azure-identity < 1.16.1`\n- `@azure/identity < 4.2.1`\n- `com.azure:azure-identity < 1.12.2`\n- `@azure/msal-node >= 2.7.0, < 2.9.2`\n- `Microsoft.Identity.Client >= 4.49.1, < 4.60.4`\n- `github.com/Azure/azure-sdk-for-go/sdk/azidentity < 1.6.0-beta.4.0.20240610221955-50774cd97099`\n- `com.microsoft.azure:msal4j >= 1.14.4-beta, < 1.15.1`\n- `Azure.Identity < 1.11.4`\n- `Microsoft.Identity.Client >= 4.61.0, < 4.61.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `azure-identity 1.16.1`\n- `@azure/identity 4.2.1`\n- `com.azure:azure-identity 1.12.2`\n- `@azure/msal-node 2.9.2`\n- `Microsoft.Identity.Client 4.60.4`\n- `github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0-beta.4.0.20240610221955-50774cd97099`\n- `com.microsoft.azure:msal4j 1.15.1`\n- `Azure.Identity 1.11.4`\n- `Microsoft.Identity.Client 4.61.3`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}