Oasis Security's research team uncovered a critical vulnerability in Microsoft's Multi-Factor Authentication (MFA) implementation, allowing

Oasis Security Research Team Discovers Microsoft Azure MFA Bypass

submited by

Style Pass

2024-12-12 14:00:09

Oasis Security's research team uncovered a critical vulnerability in Microsoft's Multi-Factor Authentication (MFA) implementation, allowing attackers to bypass it and gain unauthorized access to the user’s account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more. Microsoft has more than 400 million paid Office 365 seats, making the consequences of this vulnerability far-reaching.

The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the account holder with any indication of trouble.

Upon discovery, Oasis reported the flaw to Microsoft and collaborated with them to resolve it. Below are details of the vulnerability, its resolution, and lessons learned. You can read the Oasis Security Research team’s full report here.

After typing a valid email and password, users are asked to further verify their identity, Microsoft supports a variety of MFA methods, including a verification code from an application. Using such an application, users type in the 6-digit code to complete their authentication.