BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover

Wiz Research discovered a widespread Azure AD multi-tenant misconfiguration affecting Azure App Services and Functions that allowed authentication bypass. They demonstrated access to multiple Microsoft internal apps—most notably a Bing CMS dubbed “BingBang”—and showed they could alter search results and execute XSS that issued Office 365 tokens to exfiltrate emails, documents, and other O365 data; Microsoft fixed the issues, released guidance, and accepted the disclosure.