Forest Global Training Partners

Cyber Risks · The Hacker News

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

Summary: A development flag left enabled in production builds of six Microsoft 365 Android apps disabled the check that restricts account-token sharing to trusted Microsoft apps, letting any other app on the same phone request the signed-in user's token without a password or permission prompt. Enclave, which named the bug FlagLeft, traced it to a single line, setIsDebugMode(true), in a shared Microsoft SDK, and Microsoft issued four spoofing CVEs on May 12 covering Copilot, Word, PowerPoint, and Excel, with the patched Word build listed as 16.0.19822.20190.

Bottom line: The tokens handed over were FOCI refresh tokens that can be refreshed and reused over long stretches while the traffic looks routine in logs, and patching does not retroactively kill tokens an attacker may already hold. For any Android fleet that ran an old build alongside untrusted apps, the remaining exposure is a token that outlives the update.

Read the original at The Hacker News ↗

Topics
Identity & Access Management
Mentions
CVE-2026-41100CVE-2026-41101CVE-2026-41102CVE-2026-42832
Related