---
title: Coding Mistake Left Six Microsoft 365 Android Apps Vulnerable to Account Takeover
description: Exposed debug setting in Microsoft Android apps risked account security by disabling token checks. Patch now available for affected apps.
canonical_url: https://codekeeper.co/ticker/microsoft-android-apps-security-flaw-patched
---

# Coding Mistake Left Six Microsoft 365 Android Apps Vulnerable to Account Takeover

Exposed debug setting in Microsoft Android apps risked account security by disabling token checks. Patch now available for affected apps.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jun 4, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A debug setting accidentally left enabled in production releases of six Microsoft Android apps — Word, Excel, PowerPoint, OneNote, Loop and 365 Copilot — exposed billions of users to potential account takeover. Researchers at Enclave, who named the issue FlagLeft, found the flaw disabled a security check that prevents untrusted apps from grabbing Microsoft authentication tokens. Any malicious Android app could silently request and receive login tokens, giving attackers access to emails, Teams messages and files. Worse, the stolen tokens were long-lived FOCI (Family of Client IDs) tokens that can be refreshed indefinitely and look identical to legitimate activity in logs, making detection nearly impossible. Microsoft has patched all six apps, assigning CVE-2026-41100, CVE-2026-41101, CVE-2026-41102 and CVE-2026-42832. There's no confirmation the flaw was exploited before it was found — but if you have any of these apps installed, update them now. **Source:** [Dark Reading](https://www.darkreading.com/application-security/coding-gaffe-exposes-microsoft-365-accounts-takeover)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-android-apps-security-flaw-patched%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Settra Joins Qilin in Exploiting Palo Alto VPN Flaw Patched in May Oct 12, 2026](https://codekeeper.co/ticker/ransomware-exploit-palo-alto-vpn-vulnerability)

["Bad Epoll" Kernel Flaw Gives Attackers Root Access on Linux and Android Aug 12, 2026](https://codekeeper.co/ticker/linux-bad-epoll-vulnerability-root-access)

[Japan's Military Unknowingly Used Chinese Malware-Infected USB Drives for Nearly a Year Aug 12, 2026](https://codekeeper.co/ticker/jgsdf-malware-infected-usb-drives-expose-classified-data)

[Cyberattacks CISA's Three-Day Zimbra Patch Deadline Expires as Exploitation Spreads Aug 28, 2026](https://codekeeper.co/ticker/patch-critical-zimbra-vulnerability-prevent-exploitation)