Microsoft Authenticator flaw let malicious apps steal access tokens

Researchers at Enclave found that Microsoft Authenticator's check on calling apps only compared a self-declared redirect URI against the package signature, letting even permission-free malicious apps impersonate Teams and obtain plaintext access tokens, which could expose mailboxes, files, and calendars.