Himmelblau, an interoperability suite for Microsoft Azure Entra ID and Intune, contained an authentication bypass vulnerability in versions 2.0.0 to before 3.1.5 and 2.3.11. The vulnerability in the Device Authorization Grant (DAG) flow allowed users within the same Entra ID domain to obtain local Unix sessions as other users by providing their own valid credentials. The issue was in the token_validate function which only validated domain aliases but failed to verify that the username portion of the authenticated user's UPN matched the requested account username. The vulnerability has been fixed in versions 3.1.5 and 2.3.11.