The flaw, in Passport's password recovery mechanism, allowed an attacker to change the password on any account to which the user name is known. The flaw was disclosed late Wednesday night on the security mailing list Full Disclosure.

The simplicity of the attack and the high value of the data frequently stored in Passport accounts combined to make the vulnerability critical.

"It is hardly an exploit or even vulnerability; it's just a flaw, in their Web-application logic," the person who posted the vulnerability said in an e-mail to CNET News.com. "The flaw has been there since a long time. I just discovered it recently," wrote the individual who identified himself as Muhammad Faisal Rauf Danka. He claimed to be a Pakistani security consultant and MBA candidate.

Microsoft moved quickly to prevent online vandals from exploiting the issue. The advisory was posted just before 8 p.m. PDT, and by 11:30 p.m., the software giant had essentially turned off the vulnerable feature. "We have shut down all ability to reset passwords," said Sean Sundwall, spokesman for the company.