If authentication occurs across an external trust boundary (where the user and the computer hosting the resource are in different ...

If authentication occurs across an external trust boundary (where the user and the computer hosting the resource are in different domains), a vulnerability exists because domain {0} (the trusting domain) does not verify that the trusted domain {1} is actually authoritative for all the SIDs in the authorization data (that is, the access token). It is possible for an attacker or rogue administrator to insert SIDs into the authorization data presented to this trusting domain {0}.