Back Feeds.4Sysops

Microsoft 365 Android apps exposed account tokens via debug flag

Feeds.4Sysops •IT News • June 3, 2026

A development flag accidentally left active in several Microsoft 365 Android applications allowed unauthorized apps to bypass security checks and harvest account access tokens. This vulnerability, dubbed FlagLeft, originated from a single line of code in a shared software development kit that disabled identity verification for cross-app communication. Because the "isDebugMode" flag was set to true, any malicious application on the same device could request and receive tokens without user interaction or password prompts. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft 365 Android Apps Vulnerability Exposes User Accounts to Takeover A coding error in Microsoft 365 Android applications allowed unauthorized apps to access user account tokens, leading to potential account takeovers. This vulnerability, known as FlagLeft, was due to a debug flag left enabled in production code across six major apps, including Word and Excel. Attackers could exploit this by installing a malicious app on the same device, which could silently request and receive Microsoft account tokens without user consent. The issue affected billions of users, as any app on the device could gain access to sensitive information like emails and files. Microsoft has since patched the vulnerability, and users are urged to update their apps immediately. The vulnerability was associated with CVEs published on May 12, 2026. 8 sources 72

Extracted Entities

Microsoft 365 Android apps exposed account tokens via debug flag

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)