ROPC Grant Flow to Microsoft Graph Without MFA - CVE-2025-0309 CA Bypass

Ethan Andrews@eandrews

•updated Jun 24, 2026•2•0•13

Detects successful ROPC (Resource Owner Password Credential) token acquisitions targeting Microsoft Graph (00000003-0000-0000-c000-000000000000) where Conditional Access was not applied and only single-factor authentication was satisfied. This pattern indicates abuse of hidden CA policy scope exclusions introduced by CVE-2025-0309, enabling token issuance without MFA or device compliance enforcement.