By Mihalis Haatainen, Bountyy Oy

November 26, 2025

What happens when you disable a feature but the backend doesn't get the memo? You get a cross-tenant authentication bypass that Microsoft calls "by design."

The Discovery

During a routine penetration test, I discovered something strange in Azure API Management (APIM) Developer Portal. A client had disabled user registration - the signup page showed no form, the button was gone. Job done, right?

Not quite.

I intercepted a signup request from a different APIM instance where registration was enabled, changed the Host header to point to my client's "protected" portal, and... the account was created.

Wait, what?

The Vulnerability

Azure APIM Developer Portal has a fundamental flaw in how it handles signup restrictions:

1. Admin disables signup → UI hides the form
2. Backend API → Still accepts registrations
3. No tenant validation → Accepts requests from anywhere

The fix Microsoft implemented wasn't a fix at all. They simply hide the signup form in the UI. The API endpoint /signup remains fully functional and accepts cross-tenant requests based on the Host header.

The Attack

Here's how simple it is:

1. Find any APIM portal with signup enabled (your own works fine)
2. Fill in the signup form
3. Intercept the request in Burp Suite
4. Change the Host header to target another APIM instance
5. Submit
6. You now have an account on the target portal

POST /signup HTTP/1.1
Host: victim-portal.developer.azure-api.net  <-- Changed
Origin: https://attacker-portal.developer.azure-api.net
Content-Type: application/json

{"challenge":{...},"signupData":{"email":"attacker@evil.com",...}}

That's it. No fancy exploitation. No zero-day exploit chain. Just a Host header change.

The Impact

This isn't just a theoretical issue:

• Cross-tenant account creation on any APIM instance with Basic Auth
• Access to internal API documentation that organizations thought was protected
• Potential API key exposure depending on portal configuration
• Complete bypass of administrative controls that admins believed were working

Organizations using Azure APIM think they've disabled public registration. They haven't.

Microsoft's Response

I reported this to Microsoft Security Response Center (MSRC) on September 30, 2025. Their response after a month:

"Not a vulnerability"

I re-reported with additional technical details on November 1, 2025. Their final response on November 20:

"By design"

Let me be clear: Microsoft is aware that disabling signup in their UI does not actually disable signup. They consider this acceptable behavior.

Who Is Affected?

Your Azure APIM instance is vulnerable if:

• Basic Authentication identity provider is configured
• Developer Portal is deployed and accessible
• You think disabling signup protects you (it doesn't)

The Fix (Since Microsoft Won't)

Disabling signup in the UI is NOT sufficient.

To actually protect your APIM instance:

1. Go to Azure Portal → Your APIM instance
2. Navigate to Developer Portal → Identities
3. Delete the "Username and password" identity provider completely
4. Use Azure AD authentication exclusively

Additionally:

• Audit all existing Developer Portal accounts
• Look for accounts created after you "disabled" signup
• Monitor for unauthorized registrations

Detection Tools

I've released tools to help organizations check if they're vulnerable:

• Python scanner - Checks if your instance accepts signup requests
• Nuclei template - For automated scanning at scale

Available at: https://github.com/bountyyfi/Azure-APIM-Cross-Tenant-Signup-Bypass

Lessons Learned

This vulnerability highlights a broader problem in cloud security: UI controls are not security controls.

When a cloud provider gives you a toggle to "disable" something, you should ask:

• Does this actually disable the feature?
• Or does it just hide the button?

In this case, Microsoft chose to hide the button.

Final Thoughts

Microsoft's "by design" response is disappointing but not surprising. When vendors won't fix issues, public disclosure is the only way to protect the community.

If you're using Azure APIM with Basic Authentication - check your configuration today. Don't trust that "disabled" means disabled.

Mihalis Haatainen is a security researcher at Bountyy Oy, a Finnish penetration testing company.

Website: www.bountyy.fi

GitHub: github.com/bountyyfi

This advisory is released for defensive purposes. The tools provided are intended to help organizations identify and remediate this vulnerability in their own environments.