Microsoft just patched a nasty flaw in its Authenticator app for Android, because a malicious app with zero permissions could pose as a trusted Microsoft application, like Teams, and quietly collect sign-in tokens for your work account.
The vulnerability is tracked as CVE-2026-80097, and Microsoft fixed it in Authenticator for Android version 6.2606.4246. If you use the app on an Android device, you need to update it right now.
The Broker Flaw Explained
On Android, Microsoft Authenticator does a lot more than just display six-digit codes, because it also acts as a broker. When Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, and Authenticator hands back a token, which is a digital pass proving the user is logged in.
Because this broker controls access to your entire account, it is supposed to be very careful about which app it grants a token to. Unfortunately, this flaw let the wrong app get one.
Authenticator exposes a component called AccountChooserActivity, which any app on the device can start. When the attacker's app started it, Authenticator built its token request from values the attacker supplied, including the name of the app it claimed to be. The malicious app simply said it was Teams, and the broker believed it.
A signature check was supposed to stop this, but it completely failed. The check looked up the real signature of the app being impersonated, which was Teams, and confirmed the request matched it. Because Teams was genuinely installed on the device, its real signature was there to read, so the check passed. Authenticator could also see which app had actually made the request, but it did not use that information to decide whether to hand over a token.
The Disagreement Over User Interaction
This is where the story gets a bit messy, because the researchers at Enclave and Microsoft disagree on exactly how easy this is to pull off.
|
Source |
Stance on User Interaction |
|
Enclave Research |
Their proof of concept returned tokens without any user interaction, other than the presence of a signed-in account on the device. |
|
Microsoft Advisory |
Exploitation requires installing a malicious app and convincing the user to complete an authentication flow in Authenticator. Microsoft rates exploitation as "less likely." |
Microsoft assigned the CVE on September 8, rated it 8.6 on the CVSS scale (which it labels "Important"), and says the flaw has not been used in attacks. It was part of the September 2026 Patch Tuesday and is not listed in CISA's Known Exploited Vulnerabilities catalog.
What the Stolen Tokens Can Do
In Enclave's tests, posing as Teams and requesting Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars, among others.
Microsoft describes the result more generally, stating that a successful attacker could authenticate as the signed-in user and reach that user's resources. The tokens apply only to the work account signed into Authenticator on that device, not to other accounts.
The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published the technical details on October 23, 2026.
How to Protect Your Organization
The immediate fix is to update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- Ensure that MDM policies are enforced: Organizations that control their Androids should force their users to have at least that minimum version using the MDM platform.
- Look out for anomalies: Look for any anomalous use of the Microsoft Graph API, specifically from tokens used by unauthorized third-party apps.
- Watch for the token gap: Microsoft's advisory gives the fix but does not say whether updating the app cancels any token a malicious app may have already obtained, so that remains unclear from the available sources.
FAQ
What is CVE-2026-80097?
It is a vulnerability in Microsoft Authenticator for Android that allows a malicious app to impersonate a trusted Microsoft app (like Teams) and trick Authenticator into handing over authentication tokens.
What went wrong with the signature check?
The signature check validated the signature of the impersonated application (Teams) rather than the application that made the request. Since Teams was already installed with a valid signature, the check passed.
Does the attacker need to interact with the user?
Enclave's proof of concept did not require user interaction. Microsoft's advisory states that exploitation requires the user to complete an authentication flow in Authenticator, and rates exploitation as "less likely."
What can an attacker do with the stolen tokens?
According to Enclave, the tokens grant full access to the account's email, files, and calendar via Microsoft Graph. Microsoft notes the tokens apply only to the work account signed into Authenticator on that device.
How do I fix it?
Update Microsoft Authenticator for Android to version 6.2606.4246 or later. If you manage Android devices, enforce that minimum version through your MDM platform.
