Microsoft Authenticator

A security writeup by Faav describes a Microsoft token validation flaw where a JWT with the 'alg:none' bypass was accepted despite failing every other check. Because the validator returned granular errors — wrong tenant, wrong audience, app allowlist rejection, then 'User not found' — it effectively guided the attacker through each requirement. The writeup also mentions an AI-driven hackbot spending ten days probing email-style attack paths.

Security researcher Scott Helme has published a blog post arguing that passkeys, the passwordless authentication standard backed by Apple, Google and Microsoft, are a genuine security improvement rather than vendor lock-in or a trap for users. The piece is being actively discussed on Hacker News, where commenters are debating the usability and adoption concerns around passkeys.

Microsoft plans to shift Microsoft Authenticator's backup system on Android to Google One, with the change rolling out as part of a 2027 update. The move affects how users store and restore their account credentials, raising questions about storage limits and security under the new cloud arrangement. Cybersecurity commentators are flagging what the transition means for account recovery workflows.

Security researchers have published a two-part technical write-up of a Windows vulnerability tracked as ZDI-26-708, described as a cross-context proxy authentication coercion in the Network Connectivity Status Indicator (NCSI). The disclosure is circulating among security professionals sharing the detailed analysis. Details on affected versions and patches remain unclear from the discussion so far.

A newly disclosed vulnerability in Microsoft Exchange Server, tracked as CVE-2026-96940, carries a high severity score of 8.8. Security researchers say an authenticated attacker could bypass authorization checks and read other users' mailboxes and attachments within the same on-premises Exchange organisation. The flaw does not allow pre-authentication remote code execution, but experts are warning administrators to review exposure and patch promptly.

A medium-severity vulnerability affecting Microsoft Windows Server editions has been catalogued as EUVD-2026-73019, with a CVSS v3.1 score of 5.5 out of 10. The flaw involves missing authentication for a critical function, affecting Windows Server 2025, Windows Server 2016 (Server Core installation), Windows Server 2012 and more than sixteen other configurations. The entry was published on 8 September 2026 and updated on 7 October 2026. Administrators are advised to check whether patches are available for affected builds.

Apple Mail on Mac could stop syncing Microsoft 365 accounts as of today, according to a MacRumors report being shared as a public-service warning. Users with Outlook or Microsoft 365 email linked to the macOS Mail app are being told to watch for messages stopping or errors appearing, and to check for updates or re-authentication prompts if syncing fails.

Security firm Proofpoint reports that the threat group TA419 impersonated prominent AI-policy figures and used a real-time Microsoft 365 phishing proxy to steal authenticated login sessions. The highly targeted campaign hit fewer than ten specialists. Researchers say it shows how attackers can capture live sessions, though successful compromises and government attribution remain unclear.