This vulnerability in Microsoft Authenticator for Android (version 6.0.0) involves the exposure of sensitive information to unauthorized actors via network communication. The CVSS v3.1 score of 9.6 reflects a critical severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes complete confidentiality, integrity, and availability loss. Microsoft has acknowledged the issue and provided an official fix as detailed in their security advisory.

An attacker can disclose sensitive information over a network without privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application. This could undermine the security assurances provided by Microsoft Authenticator for Android, impacting user authentication security.

Microsoft has released an official fix for this vulnerability. Users and administrators should promptly apply the patch available from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41615. No additional mitigations are indicated beyond applying the official update.