Microsoft Authenticator could leak login codes—update your app now

**Executive summary:** A vulnerability (CVE-2026-26123) in Microsoft Authenticator for iOS and Android can leak one-time sign-in codes or sign-in deep links to a malicious app on the same device, potentially enabling account takeover and access to email, files, and cloud services; fixes are available and users should update the app or avoid installing apps that claim to handle authentication links until patched.