CVE-2026-26123: 
NixOS vulnerability analysis and mitigation

CVE-2026-26123 is an improper authorization vulnerability in Microsoft Authenticator's custom URL scheme handler that allows an unauthorized local attacker to disclose sensitive information. It affects Microsoft Authenticator for Android (versions before 6.2511.7533) and Microsoft Authenticator for iOS (versions before 6.8.40). The vulnerability was disclosed and patched on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday release. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is classified as CWE-939 (Improper Authorization in Handler for Custom URL Scheme). The vulnerability exists because Microsoft Authenticator does not properly validate or restrict which applications or URLs can invoke its custom deep link/URL scheme handler, allowing a malicious app or crafted URL to trigger the handler without proper authorization checks. Exploitation requires user interaction — specifically, a user must click or interact with a malicious URL or deep link — and the attack vector is local. A detailed write-up by the bug discoverer, Khaled Mohamed, describes the flaw as an "unclaimed deep link" that could lead to full account takeover by intercepting authentication tokens or one-time codes passed through the URL scheme (Malwarebytes Blog, InfoSec Writeups).

Successful exploitation results in high confidentiality impact with no integrity or availability impact, as classified by the CVSS score. An attacker can craft malicious URLs that exploit the improper URL scheme handler to steal sensitive information — including one-time login codes, authentication deep links, and potentially session tokens — from the local device. This could effectively bypass multi-factor authentication (MFA) protections, as the Authenticator app is a primary MFA mechanism for Microsoft accounts and enterprise Azure AD/Entra ID environments, potentially enabling full account takeover (Feedly, Malwarebytes Blog).

Exploitation has been reported in the wild according to multiple sources, including purple-ops.io, though no confirmed public proof-of-concept exploit code has been independently verified (Feedly). The EPSS score is approximately 0.036%, indicating a relatively low but non-zero probability of exploitation in the near term. No specific threat actor attribution has been publicly reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog based on available data. Exploitation requires user interaction (clicking a malicious link), which somewhat limits opportunistic mass exploitation but remains a realistic phishing-based attack vector.

1. Reconnaissance: Identify target users who have Microsoft Authenticator installed on Android or iOS devices running vulnerable versions (Android < 6.2511.7533, iOS < 6.8.40).
2. Craft malicious deep link: Create a specially crafted URL using Microsoft Authenticator's custom URL scheme (e.g., msauth:// or a related deep link scheme) that invokes the app's URL handler without proper authorization, targeting an unclaimed or improperly validated handler endpoint.
3. Deliver the payload: Distribute the malicious URL to the target via phishing email, SMS (smishing), malicious web page, or a rogue mobile application installed on the same device.
4. Trigger user interaction: Induce the victim to click or tap the malicious link, which causes the Authenticator app to process the crafted URL scheme request.
5. Intercept sensitive data: The improperly authorized handler exposes one-time login codes, authentication tokens, or deep link parameters to the calling application or attacker-controlled endpoint, bypassing MFA protections.
6. Account takeover: Use the intercepted credentials or authentication codes to authenticate to the victim's Microsoft account or enterprise services before the codes expire (InfoSec Writeups, Malwarebytes Blog).

• Network: Unexpected outbound connections from a mobile device to unknown or attacker-controlled endpoints shortly after a user interacts with a suspicious URL; authentication attempts to Microsoft/Azure services from unfamiliar IP addresses or geolocations following MFA code generation.
• Logs: Azure AD / Entra ID sign-in logs showing successful MFA authentication from an unrecognized device or location immediately after a legitimate user generates a code; sign-in events with unusual user-agent strings.
• Mobile Device: Presence of unrecognized or sideloaded applications on the device that could register competing URL scheme handlers; unexpected app-to-app communication events in device logs involving the Authenticator app.
• Behavioral: Unexpected account access or privilege escalation in Microsoft 365 or Azure environments; MFA codes used from a different device than the one that generated them; users reporting they did not initiate a sign-in that was recorded as successful (Malwarebytes Blog, Feedly).

Microsoft released patched versions on March 10, 2026: update Microsoft Authenticator for iOS to version 6.8.40 or later, and Microsoft Authenticator for Android to version 6.2511.7533 or later (Microsoft MSRC). No official configuration-based workaround has been published; updating the app is the only confirmed remediation. Organizations should enforce automatic app updates via Mobile Device Management (MDM) policies (e.g., Microsoft Intune) and educate users to avoid clicking suspicious or unsolicited URLs. Users should also avoid installing untrusted third-party applications that could register competing URL scheme handlers on their devices.

The vulnerability received notable coverage following the March 2026 Patch Tuesday release, with Malwarebytes publishing a dedicated article titled "Microsoft Authenticator could leak login codes — update your app now," which was widely syndicated across security news outlets (Malwarebytes Blog). The bug discoverer, Khaled Mohamed, was profiled by Malwarebytes for finding the flaw, and published a detailed write-up on InfoSec Writeups describing it as an "unclaimed deep link" enabling full account takeover (InfoSec Writeups). Security community discussion on Reddit, Bluesky, and Mastodon highlighted concern about the MFA bypass implications, given the widespread enterprise use of Microsoft Authenticator. Patch Tuesday roundups from Rapid7, Zero Day Initiative, Sophos, and Lansweeper all noted the vulnerability as part of the broader March 2026 update cycle (Rapid7 Blog, ZDI Blog).