Riskcovery

CVE-2024-27086

MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

State
Published
Severity
3.9 Low
Published
Apr 16, 2024
Updated
Aug 2, 2024
Reserved
Feb 19, 2024

Read the record on cve.org

Description

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Scores

CVSSScoreVectorSource
3.13.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:LGitHub_M

Weaknesses

  • CWE-926 Improper Export of Android Application Components
  • CWE-863 Incorrect Authorization

Affected Products

ProductVersions
microsoft-authentication-library-for-dotnetAzureAD
  • >= 4.48.0, < 4.59.1Affected
  • >= 4.60.0, < 4.60.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.