Microsoft Exchange ActiveSync Plaintext Credential and Token Exposure Vulnerability

A vulnerability in Microsoft Exchange ActiveSync (EAS) configurations on on-premises servers through 2019 allows for the transmission of sensitive data from Samsung mobile devices in cleartext. This includes the user's name, email address, device ID, bearer token, and base64-encoded password. The issue arises from the continued use of Basic Authentication, which was officially deprecated on October 1, 2022, yet remains active and exposes credentials and tokens to interception.

Impact

Exposed plaintext credentials and OAuth2 bearer tokens, which could be used to gain unauthorized access to user accounts, bypassing multi-factor authentication.