GHSA-mpv3-g8m3-3fjc
GitHub Security Advisory
Grafana vulnerable to Authentication Bypass by Spoofing
✓ GitHub Reviewed
CRITICAL
Has CVE
Advisory Details
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Affected Packages
Go
github.com/grafana/grafana
Affected versions:
9.4.0
(fixed in 9.4.13)
Go
github.com/grafana/grafana
Affected versions:
9.3.0
(fixed in 9.3.16)
Go
github.com/grafana/grafana
Affected versions:
9.0.0
(fixed in 9.2.20)
Go
github.com/grafana/grafana
Affected versions:
0
(fixed in 8.5.27)
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: November 25, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.