Microsoft Authenticator flaw exposed login codes and deep links

What happened

A flaw in Microsoft's official authenticator app could allow another malicious app on the same device to intercept verification codes or login deep links intended for the user.

Exploitation required the user to have set a malicious app as the default link handler, so the real-world risk was limited but credible.

What was found

The issue affected both iOS and Android and showed how trusted authentication flows can be weakened by another app's link-handling permissions. Microsoft included the fix in the current version.

Data at risk

• One-time codes
• Login links
• Account access
• Default handlers
• Authentication data
• Session security

What you should do

1. 1Update Microsoft Authenticator immediately.
2. 2Do not choose an unfamiliar app as a default link handler.
3. 3Review account sign-in history regularly.