A debug flag left active in six Microsoft 365 Android apps allowed another installed app on the same device to request account tokens without user interaction.
