What happened?
Microsoft has confirmed a critical security vulnerability in its Authenticator app that allows attackers to obtain sign-in tokens from user accounts. The flaw, identified as CVE-2026-41615, enables unauthorized parties to intercept sensitive information over the network and thereby gain access to resources that should be reserved exclusively for the legitimate account holder. Microsoft rates the risk as "critical," with a CVSS score of 9.6. Updated versions of the app are already available for download for Android and iOS.
The details
According to Microsoft's vulnerability entry, the flaw can expose the sign-in token for users' work accounts. This grants attackers access to all data and services that the affected user account is authorized to use – potentially including sensitive corporate information as well.
The attack path requires interaction from the victim: attackers must trick a person into interacting with a request that appears legitimate but is actually malicious. If the victim confirms this request, the app can be manipulated into requesting access tokens on the user's behalf. These tokens are then delivered to a service under the attacker's control. The problematic aspect: affected users receive no clear information about what access was actually granted – meaning the attack largely goes unnoticed.
The differing risk assessments are noteworthy: while Microsoft classifies the vulnerability as "critical" with a CVSS score of 9.6, NIST's NVD listing rates it at only 7.4, classifying it as "high." Microsoft also emphasizes that the vulnerability has not yet been actively exploited and that no publicly available exploit currently exists.
Assessment
Authenticator apps are generally regarded as a key component of two-factor authentication, designed specifically to prevent attack scenarios such as account takeovers. When this very protective layer becomes the point of entry, the implications are especially serious – particularly in corporate environments, where work accounts often grant extensive access to internal systems, documents, and communication platforms.
The attack vector is also noteworthy: this is not a purely technical flaw that can be exploited without any user involvement, but rather a mechanism that relies on social engineering. Users must actively confirm a seemingly legitimate request. This once again demonstrates that technical protective measures alone are insufficient when attackers target humans as the weakest link in the security chain.
The discrepancy between Microsoft's and NIST's assessments also illustrates how differently risks can be evaluated depending on the assessment methodology. For businesses and private users, what remains practically relevant is this: a critical rating from the manufacturer itself should generally be taken seriously, regardless of differing external assessments.
Practical tips
- Check immediately whether your Microsoft Authenticator is up to date. Android requires version 6.2605.2973 or later, while iOS requires at least version 6.8.47.
- The current version number can be found in the app menu under "Help" and then "About" – "Application Version."
- If automatic app updates are disabled on your mobile device, manually check the Google Play Store or the iOS App Store for updates.
- Be generally suspicious of unexpected sign-in requests or push notifications from the Authenticator, especially if they seem unusual or don't correspond to a sign-in action you initiated yourself.
- Companies should raise employee awareness about social engineering attacks, since the attack path described requires active confirmation by the user.
Outlook
Since neither active exploitation of the vulnerability nor a publicly available exploit is currently known, there is no acute pressure to act in terms of an already ongoing wave of attacks. Nevertheless, users should install the provided updates promptly to eliminate the risk of future exploitation. Experience shows that once a vulnerability is publicly disclosed, attacker interest in developing corresponding exploits tends to increase. Promptly updating the app therefore remains the most effective measure to protect against potential attacks exploiting this vulnerability.
