CVE-2025-66390 Microsoft CVE debrief

Who should care

Defenders of Microsoft Azure API Management instances should assess their configurations, especially where self-service signup with Basic Authentication is enabled, and verify if compensating controls are in place. Azure API Management administrators should review and adjust configurations, and implement additional authentication measures for sensitive operations.

Technical summary

In Microsoft Azure API Management, when self-service signup with username/password Basic Authentication is enabled in one tenant (Tenant A), an attacker can bypass signup restrictions in another tenant (Tenant B) by manipulating the hostname or tenant identifier in the registration flow. Although the UI may disable signup in Tenant B, the underlying API endpoint still accepts cross-tenant requests based on the Host header. The supplier evaluated this report and determined it did not cross a security boundary, characterizing the observed behavior as a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation.

Defensive priority

High priority for Azure API Management administrators to review and adjust configurations, verify compensating controls, and monitor for unusual signup attempts across tenants.

Recommended defensive actions

• Review and adjust Azure API Management configurations for self-service signup and Basic Authentication.
• Verify compensating controls are in place for cross-tenant requests.
• Monitor for unusual signup attempts across tenants.
• Implement additional authentication measures for sensitive operations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Further investigation is needed to determine the full scope of affected systems, verify vendor remediation, and assess potential configuration or state issues. Defenders should verify if compensating controls are in place and review Azure API Management configurations for self-service signup and Basic Authentication. Evidence limits suggest that additional review is required to fully understand the vulnerability's impact and to ensure that all necessary mitigations are in place.

Official resources