Executive brief
The Azure Key Vault Keys library for Java, which is used by developers to manage and use cryptographic keys in cloud applications, contains a security flaw in its local data verification process. An attacker could provide specially crafted encrypted data that bypasses security checks, potentially allowing them to modify data or gain unauthorized access. This issue only affects applications performing cryptographic operations locally on the client side rather than directly within the Azure Key Vault service.
Technical details
A security feature bypass vulnerability exists in the Microsoft Azure Key Vault Keys library for Java (com.azure:azure-security-keyvault-keys) due to an improper implementation of authentication tag comparison (CWE-287, CWE-347). The flaw is located within the local cryptographic verification path, where the library fails to correctly validate the integrity of encrypted input. A remote, unauthenticated attacker can exploit this by providing malicious encrypted payloads that bypass integrity checks, potentially leading to unauthorized data modification or confidentiality loss. This vulnerability specifically impacts client-side local cryptography operations; operations delegated directly to the Azure Key Vault service are unaffected. The issue is resolved in version 4.10.6.
Affected products
- Microsoft azure-security-keyvault-keys < 4.10.6
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-06-02: patched: Advisory updated with patch details