Unfixed Microsoft Entra ID Authentication Bypass Threatens Hybrid IDs

Cymulate researchers demonstrated a proof-of-concept attack against Microsoft Entra ID Pass-Through Authentication (PTA) agents in which a local administrator on a PTA server injects a DLL that intercepts ValidateCredential calls and forces successful authentication for any synced on-premises AD user across synced domains. The root issue arises when PTA agents mishandle authentication requests across multiple synced domains, allowing an attacker controlling a PTA host to impersonate users (including potentially high-privilege accounts); Microsoft plans code fixes and recommends treating PTA servers as Tier-0, enabling MFA, and implementing domain-aware routing.