9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33117

CVE-2026-33117: Security feature bypass vulnerability in Azure Key Vault Keys library for Java

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33117

CVE-2026-33117:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.azure:azure-security-keyvault-keys	maven	< 4.10.6	4.10.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a faulty authentication tag comparison within the local cryptographic operations of the Azure Key Vault Keys library for Java. The investigation started by analyzing the provided commit URLs. The initial commit was a release commit, but its changelog pointed to a pull request (#48090) that contained the actual security fix. By inspecting the commits within this pull request, it was evident that the vulnerability was in the doFinal method of the AesCbcHmacSha2 class. The patch shows that the code was incorrectly comparing the authentication tag (tag) with itself (!CryptographyUtils.sequenceEqualConstantTime(tag, tag)), which would always evaluate to true, thus bypassing the integrity check. The fix replaces this with a comparison against a newly computed tag (newTag or authTag). This vulnerability was present in two versions of the library, as indicated by the two modified files in different paths (sdk/keyvault/azure-security-keyvault-keys and sdk/keyvault-v2/azure-security-keyvault-keys). Therefore, two vulnerable functions with different namespaces have been identified.

Vulnerable functions

com.azure.security.keyvault.keys.cryptography.implementation.AesCbcHmacSha2.doFinal

sdk/keyvault/azure-security-keyvault-keys/src/main/java/com/azure/security/keyvault/keys/cryptography/implementation/AesCbcHmacSha2.java

The `doFinal` method in the `AesCbcHmacSha2` class, which is used for decryption, incorrectly compared the authentication tag with itself. This flaw allows an attacker to bypass the integrity and authenticity check of the encrypted data, as the comparison would always succeed regardless of the tag's validity. The fix corrects this by comparing the provided authentication tag with a newly computed tag based on the ciphertext.

com.azure.v2.security.keyvault.keys.cryptography.implementation.AesCbcHmacSha2.doFinal

sdk/keyvault-v2/azure-security-keyvault-keys/src/main/java/com/azure/v2/security/keyvault/keys/cryptography/implementation/AesCbcHmacSha2.java

The `doFinal` method in the `AesCbcHmacSha2` class for v2 of the library, which is used for decryption, incorrectly compared the authentication tag with itself. This flaw allows an attacker to bypass the integrity and authenticity check of the encrypted data, as the comparison would always succeed regardless of the tag's validity. The fix corrects this by comparing the provided authentication tag with a newly computed tag based on the ciphertext.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.