JSON Config File Leaks Azure ActiveDirectory Credentials

Researchers found a publicly accessible ASP.NET Core appsettings.json file leaking Azure AD ClientId and ClientSecret, which would allow attackers to use the OAuth2 Client Credentials flow to obtain access tokens, query Microsoft Graph, enumerate users and permissions, and potentially escalate to tenant compromise; the report warns this is a common cloud misconfiguration and recommends removing secrets from configs, using secrets managers (Azure Key Vault/AWS Secrets Manager), rotating credentials, enforcing least privilege, and monitoring credential use.