A publicly exposed appsettings.json containing Azure Active Directory (Entra ID) application credentials has opened a direct, programmatic path into affected tenants — a single misconfigured JSON file acting as a master key for cloud estates and enabling attackers to exchange leaked...
appsettings.json
azure ad
ci/cd security
client credentials
credential leakage
entra id
graph api
incident response
key vault
least privilege
managed identities
oauth 2.0
secretrotationsecret scanning
secrets management
service principal
A publicly exposed appsettings.json file that contained Azure Active Directory application credentials has created a direct, programmatic attack path into affected tenants — a misconfiguration that can let attackers exchange leaked ClientId/ClientSecret pairs for OAuth 2.0 access tokens and then...
Title: Urgent: CVE-2025-53793 — Azure Stack Hub “Improper Authentication” Information Disclosure (what admins need to know and do)
Lede
Microsoft has published an advisory for CVE-2025-53793 describing an “improper authentication” vulnerability in Azure Stack Hub that can allow an...