Microsoft patched a security flaw in six [1] of its Android apps that allowed any application on a device to steal user account tokens.

The vulnerability exposed sensitive data across billions [3] of app downloads, potentially giving malicious software the ability to impersonate users and access private corporate or personal information.

Security researcher Enclave discovered that a leftover debug flag remained enabled in production builds of the software [1]. This flag disabled the security check normally used to limit token sharing to trusted Microsoft applications [2]. Because the check was inactive, any app installed on the same Android device could request and obtain the signed-in user's Microsoft 365 account token [1].

Once an attacker obtained this token, they could act as the user without needing a password [1]. This access allowed for the reading of emails, opening of files, browsing of calendars, and sending of messages [1]. The flaw affected a wide range of productivity tools, including Outlook, Teams, Word, Excel, PowerPoint, and OneDrive [2].

Microsoft released patches to resolve the coding error on May 12, 2026 [1]. The company removed the debug flag to ensure that token-sharing checks are properly enforced across all production versions of the apps [2].

The flaw was publicly disclosed earlier this month [1]. The discovery highlights the risks associated with development tools and debug flags leaking into final software releases, a common but dangerous oversight in complex mobile environments [2].

“Any app on the same Android device could request and obtain the signed-in user's Microsoft 365 account token.”

This incident underscores the critical impact of 'configuration drift' where development settings accidentally persist in live environments. Because these apps are central to corporate workflows, the ability for a third-party app to bypass authentication tokens represents a significant systemic risk to enterprise security, emphasizing the need for more rigorous automated audits of production binaries.