Executive brief
Himmelblau, a tool used to connect Linux systems with Microsoft Azure Entra ID and Intune, contains a security flaw that allows one user to log into a computer as another user. If both users belong to the same organization, an attacker can use their own credentials to unlock a coworker's locked screen or start a new session as that coworker. While this gives the attacker full access to the victim's local files and private data on that specific computer, it does not grant access to the victim's cloud-based emails or Azure services.
Technical details
An authentication bypass exists in Himmelblau's Device Authorization Grant (DAG) flow due to improper validation in the 'token_validate' function. While the function correctly validates domain aliases for multi-domain environments, it fails to verify that the local username (the prefix of the User Principal Name) of the authenticated user matches the username of the account being requested. An attacker with valid credentials in the same Entra ID domain can exploit this by initiating a DAG login (often via QR code) for a victim's account and completing the flow with their own credentials. This results in a local Unix session with the victim's UID/GID and home directory access, though the underlying Entra token remains the attacker's. The vulnerability is most exploitable when 'enable_experimental_mfa' is set to false.
Affected products
- himmelblau-idm Himmelblau 2.0.0 to < 3.1.5, 2.3.11
Timeline
- 2026-05-06: patched: Fix committed to main branch
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD