CVE-2026-45108: Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow

Synopsis

An authentication bypass vulnerability in Himmelblau, an interoperability suite for Microsoft Azure Entra ID and Intune, allows an attacker with a valid low-privilege account in the same Entra ID domain to obtain a local Unix session as a different user. The flaw lives in the token_validate function of the Device Authorization Grant flow, which checked only the domain portion of a user principal name (UPN) and ignored the local username, letting a legitimate user present their own valid credentials to claim another user's session. Successful exploitation gives the attacker full access to the target account's local session, including its files, credentials, and privilege context. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The DAG flow endpoint must be reachable over the network, so the attacker must be able to reach the Himmelblau service across the network.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account in the same Entra ID domain; unauthenticated access is not sufficient to trigger the bypass.

• Victim interactionNot required

  No action from the target user or any other party is needed; the attacker operates entirely through their own session.

• Attack complexityDetail

  The attack has high complexity, meaning the attacker may need to satisfy specific environmental or timing conditions, such as the target account existing locally and the DAG flow being active, before the bypass succeeds reliably.

Blast Radius

• The attacker gains a local Unix session authenticated as the target user, reading any files, secrets, or credentials stored in that user's home directory and process environment.
• The attacker can write or modify files owned by the target user, including shell configuration files, SSH authorized keys, and application data.
• Scope is marked Changed in the CVSS vector, meaning the attacker can leverage the hijacked session to pivot into resources or services that trust the target user's local identity, beyond the original Himmelblau component.
• The target service experiences only low availability impact, so the host itself is unlikely to crash, but the target user may lose sole control of their session and associated resources.