CVE-2025-66390

Received Received - Intake

Self-Service Signup Bypass in Azure API Management

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: MITRE

Description

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-07-22

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2025-66390

EUVD

EUVD-2025-210492

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	azure_api_management	*
microsoft	azure_api_management	to 2025-10-17 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2025-66390 is a vulnerability in Microsoft Azure API Management (APIM) where attackers can bypass UI signup restrictions to register accounts on any APIM instance with Basic Authentication enabled, even when administrators have disabled user signup in the portal. The issue occurs because disabling signup in the UI only hides the signup form while the underlying signup API endpoint remains active. Attackers manipulate the Host header in signup requests to enable cross-tenant account creation.

Detection Guidance

To detect this vulnerability, check if Basic Authentication is enabled in your Azure API Management instance. Review HTTP request logs for unusual signup requests with manipulated Host headers. Use Azure CLI commands like 'az apim show' to inspect APIM configurations and identity providers.

Impact Analysis

This vulnerability allows unauthorized users to create accounts on your APIM instance, potentially gaining access to internal API documentation, subscription keys, and other sensitive resources. Attackers could exploit this to steal API keys, access restricted APIs, or impersonate legitimate users, leading to data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (healthcare data). Unauthorized account creation and data exposure may result in regulatory fines, legal liabilities, and reputational damage due to failure to maintain proper access controls.

Mitigation Strategies

Remove the Basic Authentication identity provider entirely from your Azure API Management instance. Switch to Azure AD authentication if possible. Ensure signup is disabled in the UI and monitor for unauthorized account creations.

Hi! I’m here to help you understand CVE-2025-66390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70