Active Directory Federation Services (AD FS) Spoofing Vulnerability

An authorized attacker could redirect users to a malicious website to steal credentials or impersonate legitimate services, potentially compromising access to industrial control systems or critical infrastructure that rely on AD FS for authentication.

Organizations that use Active Directory Federation Services (AD FS) for centralized authentication—particularly those protecting access to SCADA systems, HMIs, or other industrial control system management interfaces. This includes water authorities, electric utilities, and other critical infrastructure that use Windows-based identity services.

An attacker with high privileges or administrative access could craft a malicious URL within AD FS that redirects users to an attacker-controlled site. Users who click the link would be redirected away from the legitimate AD FS service to a spoofed site where credentials could be harvested or fake authentication presented.