microsoft-identity-web and stems from an authentication bypass by assumed-immutable data in Microsoft Identity Web that allows an authorized attacker to elevate privileges over a network. For development teams and enterprise administrators running applications built on this library, updating to fixed build 3.16.0 is essential to prevent cross-user token access.
Vulnerability Overview and Technical Metrics
At the core of CVE-2026-80092 is a classic architectural pitfall classified under CWE-302 (Authentication Bypass by Assumed-Immutable Data). According to the official MSRC advisory description, "Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network."
Below is the complete breakdown of the official metrics, status indicators, and scoring provided by MSRC for CVE-2026-80092:
- CVE ID: CVE-2026-80092
- Title: Microsoft Identity Web Elevation of Privilege Vulnerability
- Severity: Important
- Affected Product:
microsoft-identity-web - Fixed Build:
3.16.0 - CVSS Base Score: 5.3
- CVSS Temporal Score: 4.6
- CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness Enumeration: CWE-302
- Exploitation Assessment: Exploitation Less Likely
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
- Remediation: For microsoft-identity-web, update to fixed build 3.16.0 or later.
Section Summary: CVE-2026-80092 is an Important-severity elevation of privilege issue (CWE-302) in microsoft-identity-web carrying a 5.3 CVSS base score and 4.6 temporal score, requiring customers to update to build 3.16.0 or later.
How the Vulnerability Works and Prerequisites for Exploitation
Why does an elevation of privilege vulnerability carry a 5.3 base score with high confidentiality impact (C:H) while integrity (I:N) and availability (A:N) remain unaffected in the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C? The answer lies in what the attacker actually extracts during a successful network-based (AV:N) attack.
In its official advisory FAQ, Microsoft addresses the exact scope and operational requirements of this flaw:
- What privileges could an attacker gain by exploiting this vulnerability? An attacker could obtain another user's access token and access resources permitted by that token. The accessible resources depend on the permissions granted to the affected user's token.
- What conditions are required to exploit this vulnerability? Successful exploitation requires the application to use a shared token cache and the targeted user to have an active token in that cache.
From an engineering perspective—synthesizing general industry knowledge of how token caching works alongside Microsoft's advisory—this explains why the attack complexity is rated High (AC:H) and requires low privileges (PR:L) with no user interaction (UI:N). The attacker must already be an authorized user of the application (PR:L). Furthermore, two specific environmental conditions must align:
- The host application must be configured to use a shared token cache rather than strictly isolated per-user or per-session storage.
- The target user must simultaneously have an active token residing in that shared cache when the attacker triggers the bypass.
Because CWE-302 involves trusting data that the application assumes cannot be modified, an authenticated attacker in a shared-cache environment can manipulate the lookup or identity context to retrieve a cached access token belonging to another active user. While the vulnerability does not directly alter the underlying host system (I:N, A:N), obtaining a peer or administrator's bearer token (C:H) effectively grants the attacker whatever downstream access rights that token holds.
Section Summary: Exploitation of CVE-2026-80092 requires an authenticated attacker (PR:L), an application utilizing a shared token cache, and a targeted user with an active token currently in that cache, allowing the attacker to retrieve the victim's access token.
Affected Products and Remediation Guidance
Because microsoft-identity-web is distributed as an application library rather than an operating system component patched via a standalone Windows Update KB package, the remediation responsibility falls directly on developers and DevOps teams maintaining applications that depend on it.
| CVE ID | Affected Product | Fixed Build | Official Remediation |
|---|---|---|---|
| CVE-2026-80092 | microsoft-identity-web | 3.16.0 | For microsoft-identity-web, update to fixed build 3.16.0 or later. |
Action Plan for Development and IT Teams
Even though Microsoft's assessment is Exploitation Less Likely, and the advisory notes Publicly disclosed: No and Exploited: No, the status remains Customer action required: Yes. Applications that aggregate multiple users' tokens in a shared cache are particularly exposed if left unpatched.
To remediate CVE-2026-80092:
- Audit Application Dependencies: Check your software bill of materials (SBOM), repository dependency manifests, and build pipelines for any references to
microsoft-identity-webprior to version3.16.0. - Prioritize Shared Token Cache Deployments: Identify web applications or services configured with a shared token cache, as those meet the primary prerequisite for exploitation.
- Apply the Official Fix: For microsoft-identity-web, update to fixed build 3.16.0 or later. Rebuild and redeploy all affected services so the updated library is active in production.
Section Summary: Organizations using microsoft-identity-web must audit their applications and update the dependency to fixed build 3.16.0 or later to eliminate the shared token cache vulnerability.