The vulnerability exists because when Microsoft applications undergo the OAuth 2.0 (the next generation of OAuth) authorization flow, they trust certain third-party domains and sub-domains that ...

When developing OAuth apps, developers are given the freedom to select among various available flow types, depending on their needs, as illustrated below.