Any application that depends on CredSSP for authentication may be vulnerable to this type of attack. This security update addresses the vulnerability by correcting how CredSSP validates requests during the authentication process. To learn more about the vulnerability, see CVE-2018-0886.

This security update also enables you to configure multiple client identifiers in an OIDC-enabled SPTrustedIdentityTokenIssuer. For example, you can run the following cmdlet: