Azure's Weakest Link – Five Full Cross-Tenant Compromises

Researchers discovered five critical vulnerabilities in Azure's API Connections architecture that allow attackers to fully compromise any connection worldwide, enabling cross-tenant access to sensitive resources like Key Vaults, SQL databases, and third-party services such as Jira and Salesforce. The vulnerabilities exploit flaws in how API Management validates and routes connection tokens, allowing attackers to redirect requests to victim connections rather than their own. These findings, worth $200,000 in bug bounty rewards, reveal that the primary defense—input validation layers—is insufficient to prevent exploitation due to numerous edge cases.