Android Authenticator flaw let apps steal work tokens
Original title: Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions
An installed app with no permissions could impersonate Teams and obtain Graph tokens; fixed in 6.2606.4246.
Microsoft patched CVE-2026-80097, a high-severity local elevation-of-privilege flaw in Microsoft Authenticator for Android rated CVSS 8.6. Enclave researchers found an exported AccountChooserActivity trusted caller-supplied package identity, so a malicious app could impersonate Microsoft Teams and receive delegated tokens without user approval or extra Android permissions. Tokens could cover mail, files, calendars, SharePoint, and Teams via Microsoft Graph. Microsoft fixed it in Authenticator 6.2606.4246, released in July 2026.
Unconfirmed: The report does not say attackers exploited CVE-2026-80097 outside the researchers’ demonstration.
- The flaw required Authenticator and a signed-in work account on the same Android device.
- Signature checks validated the claimed app, not the real caller.
- Returned data could include access, refresh, and ID tokens.
- Users should update through Google Play and confirm managed devices are current.
Impact: Local theft of work-account access and refresh tokens
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Authenticator for Android | — | 6.2606.4246 |
- 1.Update Microsoft Authenticator for Android to 6.2606.4246 through Google Play.
- 2.Confirm managed devices run a current release via MDM or EMM.
- CVEs
- CVE-2026-80097
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% |
From the original article
3 min read at cybersecuritynews.com
Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8. 6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component. Microsoft classified the flaw as a local elevation-of-privilege vulnerability.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.