Authenticator
CVE-2026-26123
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
Articles & Coverage 1
AnalysisAI
Microsoft Authenticator contains an information disclosure vulnerability that allows local attackers to access sensitive data without requiring elevated privileges or user interaction beyond standard operation. The vulnerability stems from improper categorization of security controls, enabling unauthorized disclosure of confidential information on affected systems. No patch is currently available for this issue.
Technical ContextAI
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
RemediationAI
Monitor vendor advisories for a patch.
More in Authenticator
View allAuthenticator is a browser extension that generates two-step verification codes. Rated high severity (CVSS 7.8), this vu
Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be
Microsoft Authenticator Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no a
An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical a
SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a ma
pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today