Spun out of the datazoo-agent-template auth crew review (finding F5).
In the msteams Activity adapter, the caller's tenant is taken from the Activity body (channelData.tenant.id, triton-chat-msteams/src/lib.rs ~794-823) and checked only against allowed_tenants — it is never cross-checked against the verified Bot Framework / Entra token's tid.
Today this is harmless because single-tenant deployments pin a one-entry allowlist. But it becomes exploitable exactly when a deployment enables multi-tenant (allowlist holds >1 tenant): a caller verified into tenant A could assert channelData.tenant.id = B in the body and be treated as tenant B — and downstream (agent-template) mints an Escurel token scoped to B.
Ask: cross-check channelData.tenant.id against the verified token tid; reject on mismatch. This is a precondition for enabling AGENT_ESCUREL_MULTI_TENANT on the agent side (documented in datazoo-agent-template docs/escurel-auth.md and config::multi_tenant's doc-block).
Severity: medium (latent; only reachable under multi-tenant, which is currently gated off by default).
Spun out of the datazoo-agent-template auth crew review (finding F5).
In the msteams Activity adapter, the caller's tenant is taken from the Activity body (
channelData.tenant.id,triton-chat-msteams/src/lib.rs~794-823) and checked only againstallowed_tenants— it is never cross-checked against the verified Bot Framework / Entra token'stid.Today this is harmless because single-tenant deployments pin a one-entry allowlist. But it becomes exploitable exactly when a deployment enables multi-tenant (allowlist holds >1 tenant): a caller verified into tenant A could assert
channelData.tenant.id = Bin the body and be treated as tenant B — and downstream (agent-template) mints an Escurel token scoped to B.Ask: cross-check
channelData.tenant.idagainst the verified tokentid; reject on mismatch. This is a precondition for enablingAGENT_ESCUREL_MULTI_TENANTon the agent side (documented indatazoo-agent-templatedocs/escurel-auth.mdandconfig::multi_tenant's doc-block).Severity: medium (latent; only reachable under multi-tenant, which is currently gated off by default).