Cross-Tenant Signup Bypass in Microsoft Azure API Management

CVE-2025-66390

What is CVE-2025-66390?

In Microsoft Azure API Management, a vulnerability exists that allows an attacker to exploit self-service signup functionality. When this feature is enabled in Tenant A, the attacker can manipulate the registration process by altering either the hostname or tenant identifier to gain unauthorized access to Tenant B, which has the signup feature disabled at the user interface level. This behavior highlights a critical configuration oversight, as the underlying API endpoint continues to accept cross-tenant requests, indicating a potential security risk despite claims from the vendor that this does not introduce a boundary breach.

References