CVE-2026-31957
Critical
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not tenant-scoped. In this mode, Himmelblau can accept authentication attempts for arbitrary Entra ID domains by dynamically registering providers at runtime. This behavior is intended for initial/local bootstrap scenarios, but it can create risk in remote authentication environments. This vulnerability is fixed in 3.1.0.
SeverityCritical
CVSS10.0
Exploit probability—
ProductHimmelblau
PublishedMar 11, 2026
First seenMar 11, 2026
Weakness typeCWE-1188CWE-1188
How to fix
Update
- himmelblau-idm himmelblau3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| himmelblau-idm himmelblau | v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.