Windows Admin Center control flow hijacking exposes admin RCE

At a glance

What this is: This research shows how Windows Admin Center control-flow weaknesses can be chained into unauthenticated admin RCE, token theft, and Azure session hijacking.

Why it matters: It matters because hybrid management planes often inherit trust assumptions from both web apps and admin workflows, creating a single-click path from browser interaction to privileged control.

Context

Windows Admin Center is a management plane, so the core problem is not only browser exploitation but the trust model that lets a portal, gateway, and managed target exchange control data as if each response were reliable. In this case, the security gap is that server responses and redirect targets were treated as safe enough to drive privileged management actions.

For IAM and NHI teams, that matters because administrative sessions and management tokens are part of the identity surface, not just application plumbing. When a control plane can be steered through attacker-controlled flow logic, the resulting compromise reaches privilege, session, and workload access at the same time.

The article spans both Azure-managed and on-premises Windows Admin Center deployments, which makes the finding broader than a single deployment misconfiguration. It shows how the same control assumptions can fail across hybrid management paths.

Key questions

Q: What fails when a management portal trusts redirect targets and server responses too much?

A: The failure is that the browser begins to treat attacker-steered content as part of a privileged workflow. In a management portal, that can turn a simple redirect or error response into script execution, session abuse, and administrative command execution. The control that fails is not just input filtering. It is the assumption that backend responses are safe because they originate from a management service.

Q: Why do browser-stored management tokens increase compromise impact?

A: Because any script execution in that origin can read them and replay them as if it were the operator. In management tools, that turns a web flaw into session impersonation, often with cloud or infrastructure control attached. The risk is highest when the token is long-lived or has broad management scope.

Q: How can security teams tell whether a control-plane XSS issue is likely to become RCE?

A: The strongest indicator is when the script runs inside a trusted management origin and can reach administrative functions, not just display content. If the same context can trigger actions, call backend APIs, or influence embedded frames, XSS becomes a control-plane pivot. In that situation, the question is not whether code can run, but whether it can reach privilege-bearing operations.

Q: What should teams do after a management workflow exposes admin token handling to the browser?

A: They should re-evaluate the entire browser-to-management trust boundary and move critical credentials out of JavaScript-reachable storage. The key question is whether a browser compromise can still impersonate an operator or reach managed systems. If the answer is yes, the workflow is still depending on an identity assumption that does not hold under scripting abuse.

Technical breakdown

How control-flow hijacking turns a trusted redirect into RCE

Windows Admin Center accepted attacker-controlled gateway URLs without sufficiently validating the destination structure, which let the browser be steered toward a non-legitimate endpoint that still looked operational. Once the application followed that flow, server responses became part of the execution path rather than inert data. If the response handling logic trusts a remote server to behave like the expected management endpoint, the attacker can inject content into the same browser context that the admin uses to manage systems. That is why redirect validation and response validation are inseparable in management portals.

Practical implication: validate management endpoints and response shape before a browser can use them to drive privileged actions.

Why response-based XSS is the pivot point

The research shows that non-200 error responses were parsed as JSON and then rendered into the page without proper sanitization. That created a response-based cross-site scripting condition, which is more dangerous than a simple reflected input issue because the malicious payload originated from a server-like response inside the trusted workflow. In a hybrid admin portal, XSS is not just a content flaw. It becomes a privilege pivot because the script runs inside the portal-origin context, where it can manipulate portal state, trigger administrative actions, and interact with embedded frames and messages.

Practical implication: treat error messages from management backends as untrusted input and sanitize them before any rendering path.

Why local token storage widened the blast radius

On-premises Windows Admin Center stored Azure access and refresh tokens in browser local storage under the WAC domain. That design choice made the tokens directly readable by JavaScript running in the same origin, so the XSS condition became a credential theft condition. Once those tokens were captured, the attacker could impersonate the user and extend the compromise from the management portal into Azure access. In identity terms, the browser became a bearer-token vault with no effective containment once script execution was achieved.

Practical implication: remove management tokens from browser-accessible storage where a single scripting flaw can expose them.

Threat narrative

Attacker objective: The attacker aims to convert a trusted management workflow into full administrative control over managed servers and associated Azure resources.

1. Entry begins with a tampered Windows Admin Center URL that the victim can reach through a single click, masked link, or redirect from a compromised site.
2. Credential or session abuse follows when crafted responses trigger XSS and, in the on-prem Azure flow, expose Azure access and refresh tokens stored in local storage.
3. Escalation occurs when the script executes in the trusted WAC origin and can invoke management functions or force privileged PowerShell execution on managed systems.
4. Impact is administrator-level remote code execution on the gateway and managed servers, with possible Azure session hijacking and broader tenant compromise.

Breaches seen in the wild

• ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted management responses are part of the attack surface: This article shows that a control plane can fail because it trusts its own redirect targets and server responses too much. The issue is not merely bad client-side input handling, but the assumption that management backends will always return safe, expected content. In hybrid admin tools, response trust is an identity and privilege problem, not just a web security problem.

Control-flow hijacking creates identity collapse across layers: Once the browser follows attacker-steered management flow, the boundary between portal logic, session context, and privileged action disappears. That is why the same flaw can produce XSS, token theft, and administrative command execution in one chain. The practical lesson is that management-plane trust decisions need to be treated as privilege decisions, because they govern who can act on what systems.

Browser-accessible management tokens are an avoidable exposure window: The on-prem design stored Azure access and refresh tokens where JavaScript could reach them directly. That assumption was designed for a browser context that remained trustworthy; it fails once server-side script execution is possible. The implication is that bearer credentials in management workflows should not live in a place where one scripting flaw turns them into impersonation material.

Hybrid control planes need defensive validation at every handoff: The article is a reminder that Azure-managed and on-premises paths can fail in different ways while sharing the same trust pattern. A single management identity journey can cross iframe boundaries, gateway routing, JSON parsing, and token storage before reaching impact. Practitioners should treat each handoff as a governance checkpoint, because compromise often begins where one component assumes the next will behave.

What this signals

Control-plane trust is becoming the deciding security variable: Management products often fail at the handoff layer, where redirect handling, response parsing, and embedded sessions meet. Teams should test whether their admin portals still assume that a backend response is trustworthy simply because it came from a management domain.

One-click admin compromise is a governance failure, not just a bug: When a tampered URL can lead to privileged execution, the programme has lost control over where authority begins and ends. That means identity governance, secure browser handling, and admin workflow design need to be assessed together, not as separate workstreams.

Hybrid admin stacks need review around embedded portal flows, token storage, and cross-frame messaging before those design choices become incident paths. The practical question is whether a malicious page can still convert a routine management visit into a privileged session takeover.

For practitioners

• Harden management endpoint validation Reject attacker-controlled gateway URLs and enforce strict allowlists for management endpoints, certificate expectations, and redirect destinations before a browser can enter a privileged flow.
• Sanitize all server-origin error content Treat JSON error bodies, message fields, and non-200 response content as untrusted input and strip executable markup before it reaches any portal rendering path.
• Move management tokens out of local storage Store access and refresh tokens in a form that is not directly readable by browser JavaScript, especially in admin workflows that can trigger privileged Azure actions.
• Test iframe and cross-frame trust boundaries Exercise embedded portal flows, notification channels, and back-navigation paths for privilege leakage, because cross-frame messaging can turn a UI flaw into control-plane abuse.

Key takeaways

• The article shows that Windows Admin Center weaknesses can be chained into administrative RCE by abusing trust in redirects, responses, and embedded management flows.
• The compromise path spans browser context, token storage, and privileged execution, which is why the blast radius reaches both on-prem servers and Azure-linked management access.
• The most effective limiting control is to remove unsafe trust assumptions from response handling and token storage, because once script execution lands in the trusted origin the rest of the chain accelerates.

Key terms

• Control-Flow Hijacking: A condition where an attacker influences the path an application follows so that a legitimate workflow reaches an unintended destination or action. In management software, this often means redirecting trusted browser activity into attacker-controlled responses, which can then shape authentication, execution, or command delivery.
• Reflected Cross-Site Scripting: A reflected cross-site scripting flaw occurs when an application copies attacker-controlled input into the response without proper encoding and the browser executes it. The attack usually starts with a crafted link or request and succeeds when the victim loads the malicious content in an authenticated session.
• Browser local storage: A web storage mechanism that keeps data available to scripts running in the same origin. For identity teams, this is risky for tokens and session material because any script execution in that origin can read the stored value and reuse it as proof of access.
• Bearer Token: A bearer token is a credential that grants access to whoever possesses it, without requiring strong proof that the holder is the intended client. In NHI environments, that makes theft and replay the main risk, especially when tokens are long-lived, broadly scoped, or stored in local files.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.