Company Central incident
Vulnerability in Microsoft’s one‑click authentication
Resolved after 1 hour 5 minutes, affecting Hire Central and Authorization, on July 25, 2025.
We’ve identified a series of unauthorized login attempts targeting our Azure AD one‑click SSO flow. These appear to exploit a recently disclosed vulnerability in Microsoft’s one‑click authentication mechanism. What we’re doing: - Immediately disabled the affected one‑click SSO endpoint.
Affected components
Update timeline
- identified Jul 25, 2025, 07:00 AM UTC
We’ve identified a series of unauthorized login attempts targeting our Azure AD one‑click SSO flow. These appear to exploit a recently disclosed vulnerability in Microsoft’s one‑click authentication mechanism. What we’re doing: - Immediately disabled the affected one‑click SSO endpoint.
- resolved Jul 25, 2025, 08:06 AM UTC
This incident has been resolved.
Your product runs on more than Company Central
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services