Microsoft Authenticator Deep-Link Flaw Exposed Login Tokens for Account Takeover

A vulnerability in Microsoft Authenticator, tracked as CVE-2026-26123, allowed malicious Android and iOS apps to hijack the app’s unclaimed ms-msa:// deep link and intercept authentication tokens during onboarding and sign-in flows. The flaw affected QR-code-based setup scenarios in which a user scanned a legitimate Microsoft QR code with a mobile camera and opened the resulting link, enabling an attacker-controlled app to capture login data with little visible warning to the victim.

Researchers reported that the issue could lead to full takeover of Microsoft accounts and downstream access to services including Outlook, OneDrive, Teams, Office, and Skype. Microsoft acknowledged the vulnerability, assigned a CVE, and mitigated the issue, while coverage warned that the bug could expose login codes for large numbers of users on both major mobile platforms. Users and organizations were advised to update Microsoft Authenticator and ensure proper verified app-link handling as the primary remediation.