Microsoft Authenticator Isn't Magic: The Token Leak Nobody Wants to Talk About

Microsoft Authenticator Isn't Magic: The Token Leak Nobody Wants to Talk About

•

Episode description

Microsoft Authenticator Isn’t Magic: The Token Leak Nobody Wants to Talk About

Microsoft Authenticator has become the identity gatekeeper for millions of Microsoft 365 users, but CVE-2025-41615 exposes a critical flaw that can leak work account access tokens after user interaction. Noel Bradford unpacks why this ‘information disclosure’ vulnerability is really an identity compromise risk, why the CVSS score debate misses the point, and why treating MFA apps as sacred cows instead of managed software creates dangerous blind spots. This episode challenges IT providers to move beyond tick-box security, explains what access tokens actually do, and delivers a practical seven-step response plan for UK small businesses and MSPs. If your defence relies on assuming automatic updates will save you, you’re not managing risk—you’re outsourcing it to hope. MFA is essential, but the app protecting it needs governance, patching, and accountability.

Chapters

  • Intro Noel introduces CVE-2025-41615, a vulnerability in Microsoft Authenticator that can expose work account access tokens. He frames the real issue: businesses treat MFA apps as magic instead of managed software that sits inside critical identity infrastructure.
  • What a Token Actually Means An explanation of how access tokens work as temporary proof of authentication, why token theft enables attackers to act as signed-in users, and why ‘information disclosure’ labels hide serious identity compromise risks.
  • Stop Worshipping the Score Noel addresses the CVSS scoring split between Microsoft (9.6 Critical) and NIST (7.4 High), arguing that business risk assessment matters more than score theatre when the affected control is your identity gatekeeper.
  • The Sacred Cow Problem A challenge to IT providers who treat MFA as a magic shield. Noel asks who actually knows what versions users are running, whether admin accounts depend on unmanaged personal devices, and whether providers can prove their users are patched.
  • The User Interaction Excuse Needs to Die Why ‘user interaction required’ is not reassuring when attackers only need busy, distracted humans to approve one malicious request. Includes guidance on denying unexpected Authenticator prompts.
  • What to Do Today Seven practical steps for UK SMBs and MSPs: update Authenticator to safe versions (Android 6.2605.2973+, iOS 6.8.47+), prioritise privileged accounts, verify updates via MDM, review sign-in logs, consider session revocation, tighten Conditional Access, and move towards phishing-resistant authentication.
  • Outro Noel closes with reassurance that MFA remains essential but must be treated as managed software, not magic. He urges businesses to demand evidence and accountability from IT providers instead of accepting assumption as assurance.

Links