Cormac Doherty

**Name of the Vulnerable Software and Affected Versions** AAD Authentication Plugin (affected versions not specified) **Description** The Azure Active Directory (AAD) authentication implementation contains multiple weaknesses in its OAuth 2.0 authorization flow. The application uses the PHP session identifier `session id()` as the OAuth state parameter, which can leak valid session tokens through browser history, HTTP Referer headers, reverse proxies, or access logs, potentially leading to session hijacking. The implementation fails to regenerate the session identifier after successful authentication, making sessions susceptible to session fixation. Furthermore, the OAuth state value is not a single-use nonce, weakening CSRF protections and increasing the risk of replay attacks. The flow does not enforce HTTPS for the configured OAuth redirect URI, allowing authorization codes and access tokens to be transmitted in plaintext. Additionally, OAuth error responses containing attacker-controlled GET parameters are logged without sanitization, enabling log forging or log injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.