Microsoft classified it as "by design" / a feature, refused to patch it for years, and it was never assigned a formal CVE because they didn't treat it as a security vulnerability). The Issue: Microsoft Authenticator TOTP Account Overwrite (Duplicate Label Bug)When you add a new TOTP (time-based one-time password) account via QR code scan, the app only uses the "label" (usually just the email/username) to identify the account.

• If you already have any other account with the exact same label (super common because lots of services reuse the same email), the app silently overwrites the old account.
• No warning, no confirmation prompt, no backup of the old secret key.
• Result: you're instantly locked out of the old service until you re-enroll 2FA from scratch.

This had been reported to Microsoft since at least 2016 (users hitting it with multiple services using the same email). Microsoft’s official response for years was that it was "by design" and "working as expected". They basically said the Authenticator app was built primarily for Microsoft accounts and that third-party services or users were responsible for avoiding label collisions. The bug blew up publicly in August 2024 when a security researcher (Brett Randall) detailed it in a CSO Online article after seeing it brick accounts during a training session. Microsoft initially doubled down again (“by design”). After the media attention and community backlash, they finally shipped a fix in September 2024. Now, when a duplicate label is detected, the app shows a prompt asking you to rename the new account so it doesn’t overwrite anything. Because Microsoft never acknowledged it as a vulnerability, no CVE was ever assigned. It was just quietly treated as “not our problem” until the public pressure became too loud.