FlagLeft — Microsoft 365 Android Apps Silent Account Takeover via Leftover setIsDebugMode(true) FOCI Token Leak (CVE-2026-41100/41101/41102) — Threadlinqs Intelligence
As of 2026-06-03, FlagLeft — Microsoft 365 Android Apps Silent Account Takeover via Leftover setIsDebugMode(true) FOCI Token Leak (CVE-2026-41100/41101/41102) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-0671 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
A leftover debug flag — setIsDebugMode(true) — shipped in production builds of the shared Microsoft authentication/broker SDK used by six Microsoft 365 Android apps. With debug mode enabled, the
FlagLeft is an improper-access-control / token-leak vulnerability rooted in a single line of leftover debug code. Microsoft 365 Android apps share a common authentication SDK (Microsoft Authentication Library family) that implements cross-app single sign-on through an on-device account broker. By design, a 'family' of trusted first-party Microsoft apps can pass OAuth access tokens between one another without re-prompting the user — this is the Family-of-Client-IDs (FOCI) mechanism, in which apps share a Family Refresh Token (FRT) that can be redeemed for per-resource access tokens. To keep this safe, the broker is supposed to verify that any app requesting a token is itself a trusted Microsoft application, by validating the calling package's signing certificate against an allowlist before honoring the request.
The vulnerability is that the shipped production builds of six apps left the SDK configured with setIsDebugMode(true). Enclave found that 'with debug mode enabled, the protection that should have blocked untrusted apps from receiving tokens was skipped.' The debug flag removed the restriction that limited token sharing to other Microsoft apps, causing the broker to 'hand tokens to any Android app that requested them.' The same flag was correctly disabled in other Microsoft apps such as Teams, which is why Teams was not affected.
Exploitation required no exploit chain in the traditional sense — only a co-installed app. Per Enclave's Yanir Tsarimi, an attacker needed roughly 15 lines of code in a malicious Android application: 'It just seeks access to the MS app and is given the token.' The malicious app issues an ordinary broker/account request to a vulnerable Microsoft 365 app; because the debug-mode broker no longer enforces the caller-signature trust check, it returns a valid FOCI token to the untrusted caller with no user prompt and no consent dialog. The attack works fully on-device against any victim who has at least one affected Microsoft 365 app installed and signed in.
The stolen credentials are Microsoft FOCI tokens that, in Enclave's words, could be 'reused and refreshed over long periods without anyone noticing.' Because the family refresh token can be exchanged for fresh access tokens across the family scope, a single silent theft yields durable, self-renewing access. With those tokens an attacker could read emails, files, documents, communications, and calendar information, modify documents, or send communications on behalf of the victim through Microsoft Graph and related cloud APIs.
Microsoft classified the flaws as Spoofing arising from Improper Access Control and rated them Important. Three CVEs were assigned on 2026-05-12: CVE-2026-41100 (Microsoft 365 Copilot for Android), CVE-2026-41101 (Word for Android), and CVE-2026-41102 (PowerPoint for Android, explicitly improper access control); Excel, Loop, and OneNote for Android shared the same root cause. Microsoft did not publish a CVSS vector or score for these CVEs. Fixes were delivered through the May 2026 Patch Tuesday cycle and the Google Play Store (the affected components are mobile apps updated via Play, not OS security updates). No in-the-wild exploitation and no IOCs were published; this is a coordinated vulnerability disclosure. The principal residual risk is the auto-update lag window in which billions of cumulative installs may run unpatched builds.
Weaknesses (CWE)
CWE-489, CWE-284, CWE-863, CWE-522, CWE-295
Target sectors: government, financial, healthcare, technology, education, enterprise, consumer
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-41100, CVE-2026-41101, CVE-2026-41102, T1661, T1660, T1575, T1418, T1635, T1635, T1628, T1636, T1533, T1428