Authenticator
Monthly
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.
Microsoft Authenticator contains an information disclosure vulnerability that allows local attackers to access sensitive data without requiring elevated privileges or user interaction beyond standard operation. The vulnerability stems from improper categorization of security controls, enabling unauthorized disclosure of confidential information on affected systems. No patch is currently available for this issue.
Improper authentication in QNAP Authenticator 1.3.x before 1.3.1.1227 lets an unauthenticated attacker who gains physical access to the device running the mobile/companion app subvert authentication and compromise the security of the authenticator installation. The flaw is not remotely exploitable, requires passive user interaction, and is assessed as low-to-moderate real-world risk despite a 6.9 Medium CVSS 4.0 score; EPSS is 0.06% (20th percentile), and no public exploit or CISA KEV entry is identified. QNAP has released a fixed build, 1.3.1.1227 and later.
Authenticator is a browser extension that generates two-step verification codes. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Microsoft Authenticator Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions. Rated low severity (CVSS 1.9). Public exploit code available and no vendor patch available.
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.
Microsoft Authenticator contains an information disclosure vulnerability that allows local attackers to access sensitive data without requiring elevated privileges or user interaction beyond standard operation. The vulnerability stems from improper categorization of security controls, enabling unauthorized disclosure of confidential information on affected systems. No patch is currently available for this issue.
Improper authentication in QNAP Authenticator 1.3.x before 1.3.1.1227 lets an unauthenticated attacker who gains physical access to the device running the mobile/companion app subvert authentication and compromise the security of the authenticator installation. The flaw is not remotely exploitable, requires passive user interaction, and is assessed as low-to-moderate real-world risk despite a 6.9 Medium CVSS 4.0 score; EPSS is 0.06% (20th percentile), and no public exploit or CISA KEV entry is identified. QNAP has released a fixed build, 1.3.1.1227 and later.
Authenticator is a browser extension that generates two-step verification codes. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Microsoft Authenticator Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions. Rated low severity (CVSS 1.9). Public exploit code available and no vendor patch available.