Privilege escalation via trusted attacker-controlled authentication data

Authentication bypass in Microsoft Airlift.microsoft.com allows remote authenticated users to elevate privileges over a network. The service treats attacker-controllable authentication data as immutable when making an access-control decision, but Microsoft has not identified the affected field or code path. Exploitation requires existing low-privileged access and user interaction; the reported consequence is elevated access affecting confidentiality and integrity, not service availability.