50,000+ Azure AD Users Exposed via Unsecured API: BeVigil Uncovers Critical Flaw

BeVigil discovered a critical misconfiguration where a client-side JavaScript file exposed an unauthenticated API endpoint that issued Microsoft Graph tokens with overly broad permissions (User.Read.All, AccessReview.Read.All), allowing retrieval of detailed Azure AD data for more than 50,000 users including executives; recommended mitigations include restricting public API access, revoking compromised tokens, enforcing least privilege, securing front-end code, and monitoring API usage.