I'm Noel Bradford, and today the app millions of us told our users to trust has just become the story. Microsoft Authenticator — the little green tick that used to mean 'you’re safe' — has a flaw: CVE-2026-41615. It sounds like a dry line on a vulnerability list, but the reality is cinematic. An app on a phone, a single tap, and a service can be tricked into handing an attacker the very token that proves you are who you say you are. That’s not an academic problem; that’s an open door to email, Teams, SharePoint, OneDrive, finance systems and the privileged keys that run your business. Picture tokens as wristbands at a festival: once you’ve got one, you don’t queue for every stall. Great for productivity. Terrible if a thief pinches it. This flaw is an information disclosure — but the information being disclosed is an access token. An attacker still needs to trick a human into approving a legitimate-looking request, but humans are busy, distracted, and persuasive social engineers know it. ‘Requires user interaction’ is not the same as ‘hard to exploit.’ The scandal isn’t that Microsoft shipped a bug — all software has bugs. The scandal is how many organisations built their identity on an app they do not inventory, version-check, or treat as critical infrastructure. Automatic updates, wishful thinking, and an unmonitored fleet of personal phones are not a security strategy. The fix exists: updated versions (Android: 6.2605.2973+, iOS: 6.847+). The harder work is knowing who has those versions and who doesn’t. This episode walks you through what actually matters: identify which users — especially privileged ones — are exposed; push or instruct updates; verify versions; review sign-in logs; and consider revoking sessions and tightening conditional access after patching. Patching closes the door, but tokens may linger. That’s why you must treat sessions, tokens and admin accounts as living assets that need governance, not artifacts you paid once for and then hoped would behave. I’ll cut through the CVSS score arguments and the analyst chatter. Whether some lists call it critical or high, the business question is simple: can a work account token be exposed after user interaction? Yes. Is Microsoft Authenticator part of the trust chain for your cloud identity? Yes. Do many small businesses rely on it without visibility? Also yes. The answer to all three is enough to move from complacency to action. By the end of this episode you’ll understand the attack in plain English, what to check first (privileged accounts, device management, update versions), and the practical steps your MSP or in-house IT must take today. This is not fear-selling; it’s a call for grown-up identity hygiene. MFA remains essential — but it isn’t magic. Treat the app as software, the token as a valuable asset, and your identity controls as infrastructure that must be governed. Update the app. Verify the versions. Review tokens and sessions. Move high‑privilege users toward phishing‑resistant authentication. Don’t assume automatic updates are proof. Turn the green tick back into an engineered assurance, not a poster on the wall. This episode is a wake-up call for anyone who thought ticking the MFA box was the end of the story.

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related