Microsoft fixes high-severity vulnerability in Authenticator for Android
A high-severity flaw in Microsoft Authenticator for Android let installed, running malicious apps obtain tokens for signed-in work accounts without requesting Android permissions. Microsoft fixed it in version 6.2606.4246. Researchers say no further user action is needed; Microsoft says attackers must lure users into completing authentication. Microsoft said it found no evidence of exploitation when first disclosing the flaw.
Microsoft fixes high-severity vulnerability in Authenticator for Android
Microsoft Authenticator for Android had a high-severity vulnerability: a malicious app that was installed and running could obtain tokens for signed-in work accounts without requesting Android permissions. Microsoft fixed it in version 6.2606.4246.
Researchers say no further user action is required; Microsoft believes attackers would need to trick users into completing authentication. When Microsoft first published the advisory, it said it had not found the vulnerability being exploited in the wild.