--- title: Microsoft Authenticator’s Unclaimed Deep Link: A Full... description: A security researcher discovered that Microsoft Authenticator's custom deep link scheme `ms-msa://` was never actually claimed by the app itself. This meant... canonical: https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123) | daily.dev og:description: A security researcher discovered that Microsoft Authenticator's custom deep link scheme `ms-msa://` was never actually claimed by the app itself. This meant... og:url: https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve og:image: https://api.daily.dev/og/posts/Z2Fk7BKVe.png og:image:alt: Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123) **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 4 min read · 0 upvotes · 0 comments ## Summary A security researcher discovered that Microsoft Authenticator's custom deep link scheme `ms-msa://` was never actually claimed by the app itself. This meant any malicious Android or iOS app could register the same scheme and silently intercept authentication tokens generated during QR code-based account setup. The stolen token bypasses 2FA, passwords, and all other security layers, granting full access to Microsoft services including Outlook, OneDrive, Teams, and Azure. The proof-of-concept required only a simple intent-filter registration and internet permission. The vulnerability was responsibly disclosed, acknowledged as CVE-2026-26123, and patched. The fix involves proper App Link verification to prevent third-party apps from claiming official deep link schemes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [One-Click Account Takeover via Deep Link Token Auto-Append](https://daily.dev/posts/one-click-account-takeover-via-deep-link-token-auto-append-xwkhmw1s6) · InfoSec Write-ups · 0 upvotes · 0 comments - [When checking the URL isn't enough: phishing via the Microsoft identity platform](https://daily.dev/posts/when-checking-the-url-isn-t-enough-phishing-via-the-microsoft-identity-platform-wtxnir48k) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android) [View this post on daily.dev](https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123)","url":"https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve"},"datePublished":"2026-03-27T12:25:07.607Z","dateModified":"2026-03-27T12:25:38.164Z","description":"A security researcher discovered that Microsoft Authenticator's custom deep link scheme `ms-msa://` was never actually claimed by the app itself. This meant...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fdef4cdf1d2c558d648ca23b136e172?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fdef4cdf1d2c558d648ca23b136e172?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-authenticator-s-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123--z2fk7bkve","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,android","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123)"}]} ```