Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
A leftover debug flag in several Microsoft 365 Android apps let other apps on the same phone steal account tokens and act as the signed-in user. Microsoft has patched the issue.
Intelligence analysis by GPT-5.4 Mini
Enclave says a single debug setting left on in production disabled token-sharing checks across Microsoft 365 Android apps. That let a malicious app on the same device fetch reusable account tokens and access mail, files, calendar data, and messages without a password or prompt.
A tiny switch left in the wrong position let a bad app on the same phone borrow a person's Microsoft login pass. It was like a spare key hidden under the mat, so the wrong app could quietly open email and files.
Analysis
What happened
Enclave reported that a development flag, setIsDebugMode(true), was left enabled in production builds of several Microsoft 365 Android apps. That flag disabled the check that is supposed to restrict account-token sharing to trusted Microsoft apps.
The result was straightforward and dangerous: any app already installed on the same phone could ask for the signed-in user's token and receive it. With that token, an attacker could read email, open files, browse the calendar, and send messages as the victim. No password reset, login screen, or permission prompt was required.
Scope of impact
The issue affected Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote. Teams was not affected because its flag was set differently, which Enclave interpreted as an implementation mistake rather than an intended design choice. The vulnerable token flow lived in a shared Microsoft SDK, so the same flaw appeared across multiple apps.
The tokens involved were FOCI refresh tokens, which Microsoft uses for single sign-on across apps. According to the article, these tokens can be refreshed and reused over long periods, and the resulting traffic can look normal in logs. Enclave said it built a proof of concept that pulled tokens through an unverified third-party app and then read email with them.
Fix and response
Microsoft issued four CVEs on May 12: CVE-2026-41100 for Copilot, CVE-2026-41101 for Word, CVE-2026-41102 for PowerPoint, and CVE-2026-42832 for Excel. The article says Loop and OneNote were also reported but did not receive separate CVEs in that batch. Microsoft patched the apps through Google Play updates; the patched Word build is listed as 16.0.19822.20190.
The article says there is no public evidence the flaw was exploited before the fix. Still, because refresh tokens can outlive an app update, administrators may need to revoke tokens and force fresh sign-ins on devices that ran vulnerable builds alongside untrusted apps.
Key points
- A leftover debug flag in Microsoft 365 Android apps disabled token-sharing checks for trusted apps only.
- Any other app on the same device could obtain the signed-in user's token and act as that user.
- The issue affected Word, PowerPoint, Excel, Microsoft 365 Copilot, Loop, and OneNote, but not Teams.
- Microsoft issued CVEs and patched the apps through Google Play updates.
- Because refresh tokens can outlive an app update, token revocation may still be needed after patching.
Microsoft has patched the affected Android apps, and the article says the fix was pushed through Google Play updates. If users and admins update quickly, the direct token-sharing path is closed. Security teams can also reduce lingering risk by revoking refresh tokens and forcing fresh sign-ins on affected devices.
The article warns that patching the app does not automatically invalidate tokens an attacker may already hold. If a device was compromised before the update, access could continue until those tokens are revoked. Because the flaw was in a shared SDK and affected several apps, any missed update in an Android fleet could leave a broad account takeover path open.
