An "authorized attacker" could exploit this weakness to gain elevated privileges, potentially reaching SYSTEM-level access.

If you are not receiving the code on Microsoft Authenticator app, make sure Push notification is enabled, and follow the ...