Server-Side Authentication Bypass in Azure Authenticator Extension

CVE-2026-42602

What is CVE-2026-42602?

The Azure Authenticator Extension has a server-side authentication bypass vulnerability that affects versions 0.124.0 to 0.150.0. This flaw allows an attacker holding a valid Azure access token to bypass authentication for any OpenTelemetry receiver configured with the azure_auth method. The vulnerability stems from the extension’s Authenticate method failing to properly validate incoming bearer tokens as JWTs. Instead of validating the token, it compares the client’s token with a token retrieved using its own credentials. Consequently, a token associated with any Azure resource can authenticate to the collector if the attacker specifies a matching Host header. This weakens the security posture of applications utilizing the extension, as tokens can be replayed throughout their lifetime, risking unauthorized access.

References