Microsoft 365 Android Apps Expose Account Tokens Due to Debug Flag Oversight

A single line of code, "setIsDebugMode(true)," inadvertently left in multiple Microsoft 365 Android apps, created a gaping security hole that allowed other apps on the same phone to access sensitive account tokens without user permission. This tiny oversight, discovered by Enclave's Yanir Tsarimi and Ofek Levin, exposed users…

https://osintsights.com/microsoft-365-android-apps-expose-account-tokens-due-to-debug-flag-oversight?utm_source=mastodon&utm_medium=social

#Microsoft365 #Android #DebugFlag #AccountTokenExposure #MfaBypass