Microsoft Authenticator flaw (CVE-2026-26123) can leak sign-in codes

Photo by protect.computer (custom explainer graphic) on protect.computer

What happened

A medium-severity vulnerability in Microsoft Authenticator, CVE-2026-26123, can let a malicious app on the same phone capture authentication deep links and potentially expose one-time sign-in data.

The issue affects Microsoft Authenticator on Android and iOS and requires local user interaction (for example, choosing the wrong app handler for an authentication deep link).

Why this matters

Authenticator apps are part of your account recovery and multi-factor login flow. If attackers can intercept authentication links or codes on a compromised phone, they may be able to:

1. Complete sign-ins to accounts protected by Authenticator.
2. Bypass expected MFA friction during phishing-style login attempts.
3. Reuse access to pivot into email, cloud storage, or workplace apps.

What to do right now

1. Update Microsoft Authenticator from the App Store / Google Play immediately.
2. Remove unknown or recently installed apps that requested unusual permissions.
3. Review account sign-in history for unfamiliar devices and locations.
4. Revoke active sessions and rotate passwords for sensitive accounts.
5. Prefer phishing-resistant MFA where available (passkeys, hardware keys).

How to check if you’re affected

Affected services/devices:

• Microsoft Authenticator on Android and iOS devices.
• Higher risk if your phone has untrusted apps installed that can register URL handlers.

Quick verification steps:

1. Check app version now
   • Android: Play Store → Microsoft Authenticator → verify you are on the latest available build.
   • iOS: App Store → Microsoft Authenticator → verify you are on the latest available build.
2. Confirm recent unusual prompts
   • If you recently saw prompts asking which app should open a sign-in/auth link, treat as suspicious.
3. Audit account activity
   • In your Microsoft account and connected services, review recent sign-ins for unknown IPs/devices.
4. Contain if suspicious
   • Remove untrusted apps, force sign-out everywhere, and re-enroll MFA on a clean device.

Sources

• https://www.cve.org/CVERecord?id=CVE-2026-26123
• https://nvd.nist.gov/vuln/detail/CVE-2026-26123
• https://www.darkreading.com/application-security/microsoft-patches-83-cves-march-update
• https://www.malwarebytes.com/blog/news/2026/03/microsoft-authenticator-could-leak-login-codes-update-your-app-now

Bottom line

This is not a remote wormable bug, but it is still dangerous for people with risky app hygiene. Patch Authenticator immediately and review sign-in activity for signs of token or code interception.