CVE-2026-42602

The record

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).

Affected packages

Related vulnerabilities

• CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
• CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
• CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
• CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
• CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
• CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
• CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208
• CVE-2026-82449 Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check… CWE-208