
- Actor tokens allowed cross-tenant impersonation without logging or security checks
- CVE-2025-55241 enabled Global Admin access via deprecated Azure AD Graph API
- Microsoft patched the flaw in September 2025; actor tokens and Graph API are being phased out
Security researchers have found a critical vulnerability in Microsoft Entra ID which could have allowed threat actors to gain Global Administrator access to virtually anyone’s tenant - without being detected in any way.