CVE-2025-66390

Name of the Vulnerable Software and Affected Versions Microsoft Azure API Management versions prior to 2025-10-17

Description When self-service signup using username and password Basic Authentication is enabled in one tenant, an attacker can reuse the registration flow to target another tenant by modifying the hostname or tenant identifier. This occurs because disabling signup via the user interface does not disable the underlying API endpoint, which continues to accept cross-tenant requests based on the Host header. The supplier has noted that this behavior is considered a configuration or state issue rather than a breach of tenant isolation security boundaries.

Recommendations Update to the version released after 2025-10-17.