CVE-2025-66390
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Microsoft Azure API Management, when self-service signup (Basic Authentication) is enabled, an attacker can reuse the registration flow for another tenant by changing the Host header, even if signup is disabled in the UI. The vendor considers this a configuration issue, not a vulnerability.
Risk Assessment
Risk of unauthorized account creation in another tenant, potentially leading to tenant isolation breach.
Recommendation
Review API endpoint configuration and consider disabling self-service signup or applying additional network-level protections.
Original NVD description (English source)
In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation).