Oasis Security’s research team has uncovered a critical vulnerability in Microsoft’s Multi-Factor Authentication (MFA) implementation, allowing cyber criminals to bypass it and gain unauthorized access to the user’s account, including Outlook emails, OneDrive files, Teams chats, and Azure Cloud, and other Office 365 services.
Oasis Security report that the bypass was simple, took around an hour to execute, required no user interaction. It did not generate any notification nor provide the account holder with any indication of trouble.
Oasis Security Research team’s full report »
Elsewhere » The Hacker News | Security Week