Microsoft Authenticator Information Disclosure Vulnerability

A vulnerability in Microsoft Authenticator for both iOS and Android allows unauthorized actors to intercept sensitive information over the network. This issue could expose a sign-in access token for a user's work account, potentially granting access to authorized data and services, including sensitive organizational information.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of information, specifically access tokens that could be used to access a user's work account data and services.

Remediation

Users of Microsoft Authenticator on Android must manually update the app to the latest version via the Google Play Store, unless they have automatic updates enabled. iOS users can download the latest version from the Apple App Store.