GoKawiilSecurity researcher finds five cross-tenant flaws in Azure API Connections, earns $200,000 bounty
A researcher detailed five new vulnerabilities in Azure Logic Apps' API Connections feature that allowed full cross-tenant compromise, letting an attacker access another tenant's connected backends such as Key Vaults, Azure SQL databases, Jira, or Salesforce. The researcher says Microsoft paid a combined $200,000 bounty for the findings, following earlier disclosures in the same series about this architecture. The researcher plans to detail the work further in a talk at Blue Hat Asia 2026.