Microsoft's Token Theft Playbook

This vulnerability was originally discovered in March by Tenable. They could be used to leak data from other subscribers to the power platform service. Microsoft did apply an initial fix beginning of June, but well done, Tenable looked closer and early July figured out that the actual fix deployed here wasn't sufficient,. So Microsoft now hopefully fixed it completely.