Which products and versions are affected by CVE-2016-7191?

Affected: Azure Active Directory Passport (Microsoft) versions 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3; passport-azure-ad (npm) versions >= 1.0.0. The full list is in the CVE brief.

Is CVE-2016-7191 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2016-7191 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2016-7191?

No public exploit code is known.

Is there a fix for CVE-2016-7191?

Fixed versions are available, including passport-azure-ad 1.4.6, passport-azure-ad 2.0.1.

How urgently should CVE-2016-7191 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

WatchlistHigh

CVE-2016-7191Azure Active Directory Passport Authentication Bypass

Authentication Bypass in passport-azure-ad

Published Jul 26, 2018 · Updated Jul 8, 2026 · Also known as GHSA-73jp-3c67-hjfv

Key Facts

Patch in the next maintenance window

CVE-2016-7191 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Azure Active Directory Passport (Microsoft), passport-azure-ad (npm).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 29% probability of exploitation in the next 30 days.
Fixed versions are available, including passport-azure-ad 1.4.6, passport-azure-ad 2.0.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Scores

CVSS v3.1

8.1

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

29%

Higher than 98.1% of all scored CVEs

Exploit maturity

None known

ATLAS score

34/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

None known

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2016-7191
advisoryGHSA advisory

Description

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

Affected Products

19 affected entries in total

Product	Affected versions	Fixed in
Azure Active Directory PassportMicrosoft	1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3	n/a
passport-azure-adnpm	>= 1.0.0	1.4.6

Patched Releases

passport-azure-ad

1.4.6, 2.0.1

Timeline

Publicly disclosed
Jul 26, 2018
Last updated
Jul 8, 2026

Weakness Type

CWE-287 Improper Authentication

References

4 more references in the full CVE brief

FAQ

Common Questions.

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Affected: Azure Active Directory Passport (Microsoft) versions 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3; passport-azure-ad (npm) versions >= 1.0.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including passport-azure-ad 1.4.6, passport-azure-ad 2.0.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2016-7191 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.