CVE-2019-1258: Vulnerability in Azure Active Directory Authentication Library
Summary
CVE-2019-1258: Vulnerability in Azure Active Directory Authentication Library. Affects microsoft.identitymodel.clients.activedirectory versions >= 5.0.0, < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Azure Active Directory Authentication Library (ADAL) is a NuGet package that provides authentication functionality for applications using Azure Active Directory. It allows developers to easily integrate authentication and authorization into their applications. ADAL is widely used in various applications and frameworks.
Vulnerability Detail
An elevation of privilege vulnerability has been discovered in the On-Behalf-Of flow of Azure Active Directory Authentication Library. The vulnerability is related to the way the library caches tokens. An attacker could exploit this vulnerability to elevate their privileges and potentially gain unauthorized access to sensitive information or perform unauthorized actions.
How To Fix
Latest published version: 5.3.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected package to the fixed version.
Conclusion
The Azure Active Directory Authentication Library (ADAL) is affected by an elevation of privilege vulnerability in the On-Behalf-Of flow. It is crucial to update the affected package to version 5.2.0 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for microsoft.identitymodel.clients.activedirectory →
FAQ
The vulnerability allows an attacker to elevate their privileges and potentially gain unauthorized access to sensitive information or perform unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your packages.config file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the affected package to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-xc6x-cq47-9chw/GHSA-xc6x-cq47-9chw.json
