Critical
Security advisory
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-3128
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 13:16 UTC · Revision 1
Source evidence
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
osv:CVE-2023-3128
Complete source record
{
"id": "7b7a9b306f18ec657c266cce1c1e2e3f227bacd15d561ed30af7d5b9cc6fae95",
"url": "https://osv.dev/vulnerability/CVE-2023-3128",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-3128",
"summary": "Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.",
"evidence": "osv:CVE-2023-3128",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2023-3128",
"aliases": [
"BIT-grafana-2023-3128",
"CVE-2023-3128",
"GHSA-gxh2-6vvc-rrgp",
"GHSA-mpv3-g8m3-3fjc"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/grafana/grafana",
"type": "GIT",
"events": [
{
"introduced": "c4656a885d92ccc5eaaf71747cd5c236c133a21f"
},
{
"fixed": "5f9e0ace7eb4001f4106f912b0549936db87c68f"
},
{
"introduced": "c7eea48209eb93819a0ab7593921fffba5b2d339"
},
{
"fixed": "8d9c05a1601f5324cb465950728ce6155f5ab44b"
},
{
"introduced": "e9cb2a313ecc5a8e3cfeca7d2b7df2878802096e"
},
{
"fixed": "07b83b72be8497c2060810a6d242d180781459ce"
},
{
"introduced": "dbb869b17343d20a73521ada8ff61d639abe23b7"
},
{
"fixed": "e63c0e529c6fbb06a2efcb0d38f4fc22c0ebd4dd"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "6.7.0"
},
{
"fixed": "8.5.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "6.7.0"
},
{
"fixed": "8.5.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.20"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.20"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.13"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3128.json"
}
}
],
"modified": "2026-10-28T02:30:50.671477417Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3128.json",
"https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp",
"https://grafana.com/security/security-advisories/cve-2023-3128/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-3128",
"https://security.netapp.com/advisory/ntap-20230714-0004/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-290"
],
"cna_assigner": "GRAFANA",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.4"
},
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.13"
},
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.16"
},
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.20"
},
{
"introduced": "6.7.0"
},
{
"fixed": "8.5.27"
},
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.4"
},
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.13"
},
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.16"
},
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.20"
},
{
"introduced": "6.7.0"
},
{
"fixed": "8.5.27"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3128.json"
}
},
"related_cves": [
{
"value": "CVE-2023-3128",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 519419,
"published_at": "2023-06-22T20:14:00.805+00:00"
}