Microsoft Authenticator for Android and iOS contains a flaw that permits an unauthorized actor to retrieve sensitive information over the network. The vulnerability is classified as Information Exposure (CWE-200), indicating that confidentiality of the data handled by the authenticator is at risk if exploited.

The flaw affects Microsoft Authenticator applications on Android and iOS platforms. Version details are not specified, so the vulnerability could potentially impact any builds of the authenticator until Microsoft releases a fix.

The high CVSS score of 9.6 reflects a severe confidentiality impact and the potential for widespread exploitation. The EPSS score is not available, which indicates limited public data about current exploitation attempts and leaves uncertainty about how frequently attackers may target this vulnerability. The description states that the information can be disclosed over a network, so based on the description, the likely attack vector is inferred to involve an adversary manipulating or intercepting the authenticator’s network traffic. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of a high severity score and the ubiquity of the authenticator suggests that prompt remediation is advisable.