CVE-2024-27086

LowCVSS 3.9/10Last modified Jun 17, 2026

Description

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863 CWE-926

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-270875.4Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the en CVE-2024-270885.5es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `CVE-2024-27098.8A vulnerability was found in Tenda AC10U 15.03.06.49. It has been classified as critical. Affected is the function fromSetRouteStatic of the CVE-2024-270905.3Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2024-270916.1GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within CVE-2024-270925.4Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send ema CVE-2024-270937.5Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository CVE-2024-270947.4OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating CVE-2024-270954.8Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify so CVE-2024-270966.5GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-270975.3A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an at CVE-2024-270989.6GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.