CVE-2025-21396 Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network

Description

Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Account	Versions not published

Other CVEs of Microsoft Account

The 3 CVEs of Microsoft Account →

CVE-2026-56165 Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network 9.8 Critical CVE-2026-21264 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an… 9.3 Critical