Collected research

Azure B2C Crypto Misuse and Account Compromise

Technical Advisory - Azure B2C - Crypto Misuse and Account Compromise

Justin Copeland and @praetorianlabs · Praetorian · 15 February 2023

Azure AD B2C custom policies follow Microsoft's own tutorial in encrypting OAuth refresh tokens under an RSA key, but RSA encrypts with the public half, which is not a secret. An attacker who recovers that public key can mint a refresh token carrying any claims for any user and redeem it for a session, taking over accounts without credentials; the researchers demonstrated it against Microsoft's own MSRC researcher portal to read other people's vulnerability reports.

Record

Document

Technical Advisory - Azure B2C - Crypto Misuse and Account Compromise

Researcher

Justin Copeland and @praetorianlabs

Published by

Praetorian

Date

15 February 2023

Topic

Crypto

In the archive

• Collected in the 2023 research round

Tags

• auth-bypass
• jwt
• oauth
• openid
• sso
• azure
• info-leak
• privilege-escalation
• case-study
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Justin Copeland and @praetorianlabs, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.