The vulnerability identified in Microsoft Authenticator permits an unauthorized local attacker to disclose sensitive information. Key detail from vendor description: "Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally." This weakness aligns with CWE-939, indicating that the application exposes data through improper handling of authentication or input validation, potentially leading to partial or full disclosure of user data or operational details. The impact scoped to confidentiality loss without affecting integrity or availability.

Affected products are Microsoft Authenticator for Android and Microsoft Authenticator for iOS, as indicated by the CNA vendor list. No specific version ranges were provided in the data; hence, all currently deployed instances of these apps are potentially vulnerable until a patch is applied.

The CVSS base score of 5.5 reflects moderate severity, while the EPSS score of <1% indicates low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because it requires local or device‑based access, the attack vector is inferred to be local. While the impact is limited to information disclosure, the low likelihood of exploitation combined with the potential damage to user privacy suggests that organizations should treat this as a moderate risk warranting prompt remediation.