Azure Entra ID: OAuth Device Code Grant Flaw Exposes Arbitrary Tenant Data

The ZDI-26-629 advisory, published by the Trend Micro Zero Day Initiative on September 9, 2026, under coordinated disclosure, documents a vulnerability in the Microsoft Azure Entra ID OAuth Device Code Grant endpoint. A remote, unauthenticated attacker can obtain internal organizational information on arbitrary tenants simply by interacting with error messages generated by the platform. The case reveals a passive reconnaissance vector in cloud identity that remains exposed until the official fix is released.

The Mechanism: When an OAuth Error Becomes an Intelligence Vector

The endpoint in question implements the OAuth 2.0 Device Authorization Grant, RFC 8628, designed for devices with limited input such as smart TVs, printers, or IoT tools. The flow requires the device to request a code, the user to enter it on a second device, and the original device to obtain access tokens after polling.

According to advisory ZDI-26-629, the specific flaw lies in the generation of error messages that include sensitive data. These details, normally hidden from unauthorized users, are returned in cleartext when the endpoint receives malicious or simply malformed input. The critical condition is that the attacker needs neither valid credentials nor apps registered on the target tenant.

"An attacker can leverage this vulnerability to disclose internal organizational information associated with arbitrary Entra ID tenants." — Advisory ZDI-26-629

The absence of authentication transforms the vector from an information disclosure issue into a mass reconnaissance tool. An operator can cycle through tenant IDs or known domains, collect error responses, and reconstruct information on the target's cloud identity infrastructure.

Timeline and Disclosure Status: Five Months Between Report and Publication

The vulnerability was reported to Microsoft on March 31, 2026, by Nelson William Gamazo Sanchez, a researcher at Trend Micro Research. The coordination period between report and public disclosure spanned over five months, with the ZDI advisory release set for September 9, 2026. This window reflects standard responsible vulnerability management practices, but leaves an interval during which technical details remain confined to the vendor and the researcher.

The advisory does not specify whether Microsoft released a patch during the coordination period. The vendor link indicated by ZDI points back to the same advisory page, suggesting that the official fix or Microsoft bulletin had not yet been published at the time of coordinated release.

Exposed Information: What We Know and What Is Missing

ZDI-26-629 classifies the impact as information disclosure of "internal organizational information." However, the advisory does not detail the exact nature of this data. It remains unspecified whether error messages reveal tenant names, directory identifiers, policy configurations, user presence, or other infrastructure metadata.

This gap has concrete operational consequences. Without knowing the exact content of the disclosed information, defenders cannot calibrate the severity of the risk or identify which organizational intelligence assets are potentially already exposed. The dossier does not provide examples of payloads or HTTP requests that trigger the vulnerable condition, limiting the capacity for controlled reproduction.

No CVE assignment or CVSS score is documented in the advisory either. This absence, not unusual in pre-disclosure phases, prevents formal tracking through national databases and complicates automatic prioritization in vulnerability management systems.

Immediate Actions

• Check Azure Entra ID logs for anomalous access to the Device Code Grant endpoint from IP addresses not associated with authorized devices
• Contact Microsoft security teams to request information on patch status and details on the information actually exposed
• Monitor for CVE assignment and publication of an official Microsoft bulletin for traceability of the issue
• Review the visibility of organizational metadata in Entra ID configurations, reducing information exposed in system responses where possible

Analysis: Cloud Identity as a Passive Reconnaissance Surface

This advisory exemplifies an emerging pattern in the cloud threat surface: standardized authentication endpoints, designed for interoperability and usability, become sources of passive intelligence when their error responses are not sufficiently sanitized. The OAuth Device Code Grant is particularly exposed because its design anticipates initial interaction without user authentication.

The ZDI-26-629 case fits into a broader context of cloud identity reconnaissance: previous research has demonstrated how tenant enumeration, user enumeration, and metadata harvesting on SaaS identity platforms provide foundations for spear-phishing and targeted enterprise attacks. The novelty here is the absence of any authentication prerequisite, which drastically lowers the barrier to accessing the vector.

For Microsoft, managing this disclosure intersects tensions between coordinated transparency and protection of the installed base. For tenant organizations, the risk is not immediate compromise but systematic reconnaissance that prepares subsequent attacks: knowing the structure of an Entra ID before obtaining credentials is a measurable tactical advantage.

FAQ

Is an Azure account required to exploit this vulnerability?

No. Advisory ZDI-26-629 explicitly documents that authentication is not required to exploit the flaw.

Is a CVE or CVSS score available?

No CVE has been assigned and no CVSS score published in advisory ZDI-26-629 as of the coordinated release on September 9, 2026.

What information is actually disclosed?

The advisory generically indicates "internal organizational information" but does not specify the exact nature of the data exposed in error messages.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-629/
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html