Debug Flag in Microsoft 365 Android Apps Exposed Account Tokens to Any App

Researchers at Enclave disclosed a vulnerability dubbed FlagLeft in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, setIsDebugMode(true), left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote; Teams was reportedly not affected because its production debug flag was configured correctly.

Because the apps relied on FOCI token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including email, OneDrive files, calendars, and messaging functions without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from 4.4 to 7.7—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.