BingBang: How a simple developer mistake could have led to Bing.com takeover

Wiz Research disclosed “BingBang,” an Azure Active Directory multi-tenant misconfiguration in a Microsoft app that allowed researchers to access a Bing CMS, alter live search results, and demonstrate an XSS vector capable of stealing Office 365 access tokens from users; the issue was responsibly reported and remediated by Microsoft.