InfoSecBulletin Cybersecurity for mankind
Oasis Security discovered a flaw in Microsoft’s Multi-Factor Authentication (MFA) system, allowing attackers to bypass it and access user accounts, including Outlook, OneDrive, Teams, and Azure. With over 400 million Office 365 users, the impact of this vulnerability could be significant.
Research team claim, “The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the account holder with any indication of trouble.”
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
Bengaluru firm got ransomware attack, Hacker demanded $70,000
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today
When users access the login page, they receive a session identifier. After entering a valid email and password, they must verify their identity. Microsoft offers various MFA methods, such as using a verification code from an app. Users enter a 6-digit code from the app to complete the authentication. Up to 10 consequent failed attempts were allowed for a single session.
The Oasis research team quickly generated new sessions and codes, demonstrating that they could rapidly exhaust all options for a 6-digit code (1 million combinations). In simple terms, they could make many attempts at once.
Oasis informed Microsoft of the issue, which acknowledged its existence in June and fixed it permanently by Oct. 9, the researchers said. “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts; the strict limit lasts around half a day,” Hason wrote.
Vulnerability timeline and Microsoft response:
24/06/2024 – Microsoft Acknowledgment of the issue
04/07/2024 – Microsoft Deployed a temporary fix
09/10/2024 – Microsoft Deployed Permanent Fix
Click here to read the full story.
Source: oasis.security
