Android Microsoft Authenticator flaw let apps steal account tokens
Original title: Microsoft Authenticator Flaw Allows Android Apps With Zero Permissions to Steal Authentication Tokens
CVE-2026-80097, scored 8.6, affects builds before 6.2606.4246; a zero-permission app could impersonate Microsoft apps.
Enclave found that exported AccountChooserActivity trusted identity details supplied by the caller instead of confirming the real calling app. A malicious app with no Android permissions could obtain access, refresh, and ID tokens for a signed-in work account. Microsoft rated it an elevation-of-privilege flaw, shipped a fix, and published an advisory on September 8, 2026.
Unconfirmed: The report describes researcher testing, not confirmed attacks against users.
- Fixed version is Microsoft Authenticator 6.2606.4246 or later.
- Impersonating Teams in testing produced Microsoft Graph access to mail, files, calendar, and chat.
- Microsoft mapped the bug to CWE-287, Improper Authentication.
- Redirect checks validated the claimed package signature, not the actual caller.
Impact: Theft of access, refresh, and ID tokens
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Authenticator | earlier than 6.2606.4246 | 6.2606.4246 |
- 1.Update Android Microsoft Authenticator to version 6.2606.4246 or later.
- 2.Watch managed Android devices for unexpected Microsoft Graph token use.
- CVEs
- CVE-2026-80097
- Vendors
- Microsoft
- Products
- Microsoft Authenticator
- Organizations
- Enclave
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% |
From the original article
2 min read at gbhackers.com
A high-severity vulnerability in Microsoft Authenticator for Android could let a malicious app, without any Android permissions, impersonate trusted Microsoft apps and steal authentication tokens for a victim’s signed-in work account. This vulnerability is tracked as CVE-2026-80097 and affects Microsoft Authenticator versions earlier than 6. 2606.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.