Microsoft Authenticator Android flaw let apps steal work tokens
Original title: Microsoft Authenticator vulnerability let rogue Android apps steal work account access
Versions before 6.2606.4246 are affected; Microsoft rated CVE-2026-80097 at CVSS 8.6 and shipped a fix on September 8, 2026.
Enclave researcher Ofek Levin found that Microsoft Authenticator on Android could be asked for sign-in tokens by any local app without checking the real caller. A malicious app could impersonate Teams or Authenticator itself and obtain tokens for mail, files, calendar, SharePoint, Teams, and sign-in method changes, including passkeys. Microsoft confirmed the flaw as CVE-2026-80097. The attack still required the victim to install a malicious app, after which token theft was silent.
Unconfirmed: The report does not say whether attackers exploited the flaw before the fix.
- All Android Authenticator versions before 6.2606.4246 are affected.
- The fixed release is 6.2606.4246 or later.
- Microsoft published the CVE on September 8, 2026, with CVSS 8.6.
- A planted passkey could persist after the malicious app was removed.
- Enclave reported the issue through responsible disclosure.
Impact: Steal work-account tokens and change sign-in methods
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Authenticator for Android | before 6.2606.4246 | 6.2606.4246 |
- 1.Update Microsoft Authenticator to version 6.2606.4246 or later.
- 2.Have MDM enforce Authenticator 6.2606.4246 as the minimum version.
- 3.Avoid sideloading or installing unfamiliar apps outside trusted stores.
- CVEs
- CVE-2026-80097
- Vendors
- Microsoft
- Products
- Microsoft Authenticator
- Organizations
- Enclave
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% |
From the original article
2 min read at helpnetsecurity.com
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.