Loading vulnerability…
Microsoft Authenticator Deep Link Interception Information Disclosure
CVE-2026-26123 is an information disclosure vulnerability in Microsoft Authenticator for Android and iOS. Based on the provided content, the issue stems from Microsoft Authenticator not properly claiming or exclusively handling the ms-msa:// deep link used during onboarding, sign-in, and QR-code-based 2FA setup flows. Because the scheme was not securely bound to the legitimate app, a malicious application installed on the same device could register itself as a handler for the ms-msa scheme and receive authentication data intended for Microsoft Authenticator. Reported intercepted data includes authentication tokens, one-time login codes, and special sign-in links embedded in the deep link. In the described attack flow, a victim scans a legitimate Microsoft QR code or taps a sign-in link, then the malicious app is selected to open the deep link, allowing it to extract the code parameter and exfiltrate it. The vulnerability is local to the device and depends on user interaction, but it can undermine MFA workflow integrity and enable unauthorized access to Microsoft accounts and related services.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose authentication material intended for Microsoft Authenticator, including sign-in tokens, one-time codes, or deep-link-based authentication data. According to the provided reporting, this may allow an attacker to complete authentication flows, access the victim’s Microsoft account, and potentially reach associated services such as Outlook, OneDrive, Teams, Office, Skype, and other cloud-backed data. The content further indicates the flaw could enable full account takeover in some scenarios and weaken or bypass the intended protection provided by MFA workflows.
If you can’t patch tonight, do this now.
Until all affected devices are updated, reduce exposure by preventing installation of untrusted or unnecessary mobile applications, especially apps that could register handlers for authentication-related links. Instruct users to verify that authentication links and QR-based sign-in flows open only in trusted apps such as Microsoft Authenticator. For enterprise environments, use MDM / mobile application control policies to enforce timely patching of MFA apps and restrict risky app installation where possible. The content also notes Microsoft Entra-related controls being rolled out to restrict Authenticator use on rooted or jailbroken devices, which may further reduce risk in managed environments.
Patch, then assume compromise.
Update Microsoft Authenticator to the latest fixed version from the Apple App Store or Google Play Store. The provided content indicates Microsoft acknowledged and mitigated the issue in recent versions. The underlying fix described by the reporting is proper app-link verification / verified deep-link handling so that the ms-msa:// authentication flow is securely bound to Microsoft Authenticator rather than being claimable by arbitrary apps.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.