CVE-2025-66390
In Microsoft Azure API Management, enabling self‑service signup in one tenant lets an attacker register in another tenant by changing the hostname, even if signup is disabled in the UI. The vendor says this is a configuration issue, not a product flaw that crosses tenant boundaries.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure API Management (all versions up to 2025‑10‑17) for tenants that enable self‑service signup.
Real-world impact
An attacker could create accounts in other tenants, potentially accessing resources or services that belong to those tenants.
Why this severity
The CVSS score of 9.8 reflects a network‑based attack with low complexity, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.
What to do about it
- ›Verify that signup is disabled at both the UI and underlying API levels; adjust configuration to block cross‑tenant registration requests.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.