Collected research

BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover

Hillai Ben-Sasson · wiz.io · 29 March 2023

Azure AD multi-tenant applications that switch on built-in authentication but never check the tenant claim let any Azure account sign in, and about 25 percent of scanned multi-tenant apps were affected. Wiz used it against Microsoft's own Bing Trivia CMS to edit live Bing.com search results and land stored XSS on bing.com, stealing Office 365 tokens for victims' Outlook mail and SharePoint files.

Record

Researcher

Hillai Ben-Sasson

Published by

wiz.io

Date

29 March 2023

Topic

Identity

In the archive

• Collected in the 2023 research round

Tags

• auth-bypass
• xss
• oauth
• sso
• azure
• jwt
• info-leak
• large-scale-scan
• case-study
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Hillai Ben-Sasson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.