Authenticator for Android flaw let apps steal work tokens (CVE-2026-80097)
Original title: Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Fixed in version 6.2606.4246; Microsoft says it was not used in attacks and rates exploitation less likely.
Microsoft fixed CVE-2026-80097 in Authenticator for Android, where a permissionless app could start AccountChooserActivity, impersonate an installed Microsoft app such as Teams, and receive work-account sign-in tokens. Enclave researcher Ofek Levin published details on October 23 after tests that obtained Microsoft Graph access to mail, files, and calendars. Microsoft rates it 8.6 Important, says a sign-in step is required, and says it was not exploited or disclosed before the fix.
Unconfirmed: Enclave says its proof of concept needed no user interaction beyond a signed-in account; Microsoft says a completed Authenticator sign-in is required.
- The fix is Authenticator for Android 6.2606.4246 or later.
- Microsoft assigned the CVE on September 8 and shipped it in September 2026 Patch Tuesday.
- Tokens apply only to the work account signed in on that device.
- It was not in CISA's Known Exploited Vulnerabilities catalog as of October 26, 2026.
- Whether the update revokes tokens already taken is not stated.
Impact: Work-account tokens for mail, files, and calendars
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Authenticator for Android | — | 6.2606.4246 |
- 1.Update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- 2.Require that minimum version on managed Android devices.
- CVEs
- CVE-2026-80097
- Vendors
- Microsoft
- Products
- Microsoft Authenticator
- Organizations
- Enclave
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% |
From the original article
3 min read at thehackernews.com
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6. 2606.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.