diff --git a/src/server/api/Sprk.Bff.Api/Sprk.Bff.Api.csproj b/src/server/api/Sprk.Bff.Api/Sprk.Bff.Api.csproj
index d0e1b2ed..82442dcf 100644
--- a/src/server/api/Sprk.Bff.Api/Sprk.Bff.Api.csproj
+++ b/src/server/api/Sprk.Bff.Api/Sprk.Bff.Api.csproj
@@ -32,7 +32,7 @@
     <!-- Microsoft Identity (CRITICAL - must be 3.x or higher) -->
     <!-- Identity.Web 3.8.2+ fixes CVE-2025-32016; requires Identity.Client >= 4.70.0 -->
     <PackageReference Include="Microsoft.Identity.Client" Version="4.70.0" />
-    <PackageReference Include="Microsoft.Identity.Web" Version="3.8.2" />
+    <PackageReference Include="Microsoft.Identity.Web" Version="4.2.0" />
     <PackageReference Include="Microsoft.Identity.Web.MicrosoftGraph" Version="3.8.2" />
     <PackageReference Include="MimeKit" Version="4.8.0" />
     <PackageReference Include="MsgReader" Version="5.2.0" />