Chain of flaws could result in Outlook, Store, and Sway account compromise

A chain of vulnerabilities left Microsoft user accounts open to takeover, new research reveals.

Working in partnership with independent antivirus review site, SafetyDetective, India-based security researcher Sahad Nk was able to take control of a misconfigured Microsoft subdomain,, and thus whatever data was sent to it.

“The subdomain was pointing to a Microsoft Azure Web App service with its CNAME record,” reads a blog post from SafetyDetective, published earlier this week.

“During a simple host check, we realized the application was no longer up, and we were able to take over the subdomain by registering an Azure web-app with the name successcenter-msprod.”

After taking control of the subdomain, the researcher found that improper OAuth checks in Microsoft Outlook, Store, and Sway could enable an attacker to log in as the victim – albeit after they had clicked on a malicious link.

Even if the authentication initiator is or, is allowing as a valid redirect URL and sending the login tokens to this domain we now control.

This resulted in a token leakage to our server. One can exchange this token for a session token and use the tokens to log in as the victim without knowing any username/password.

This is meant to bypass all the OAuth and get a valid token; when a victim clicks on the [malicious] link, we will be able to take over their account.

The flaws were disclosed to Microsoft back in June and were fixed last month.

RELATED: Subdomain autofill feature raises questions over LastPass security