Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Microsoft fixed Android Authenticator flaw that stole work tokens

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 27: The Hacker News says Microsoft saw no exploitation, requires a sign-in step, and the bug was absent from CISA’s KEV list as of October 26. Levin published details October 23. Token revocation after update is unstated.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Microsoft patched CVE-2026-80097 in Authenticator 6.2606.4246 and says the token-theft bug was not exploited.

A zero-permission Android app could start Authenticator’s AccountChooserActivity, impersonate Teams or Authenticator, and receive access, refresh, and ID tokens for a signed-in work account. Enclave’s Ofek Levin found the activity trusted caller-supplied identity; tokens could reach Microsoft Graph mail, files, calendars, SharePoint, and Teams. Help Net Security also reports sign-in changes and passkeys that could remain after the malicious app was removed. Microsoft rated CVE-2026-80097 at CVSS 8.6 (CWE-287) and fixed it in 6.2606.4246. Cyber Security News dates that build to July 2026; other outlets cite a September 8 advisory and September Patch Tuesday. The Hacker News says Microsoft requires a sign-in step, reports no pre-fix exploitation, and that it was not in CISA’s KEV catalog as of October 26.

Key facts
  • Fixed in Microsoft Authenticator for Android 6.2606.4246 or later.
  • Attack needs a malicious app and a signed-in work account on the device.
  • Returned data can include access, refresh, and ID tokens.
  • Help Net Security: a planted passkey could persist after app removal.
  • The Hacker News: Microsoft says exploitation is less likely and unseen.
  • Outlets disagree on a July versus September 2026 fix date.
Analyze CVE-2026-80097 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Sep 8, 2026Microsoft published the CVE advisory · Help Net Security
  2. Oct 23, 2026Ofek Levin published technical details · The Hacker News
  3. Oct 26, 2026Flaw was not in CISA’s KEV catalog · The Hacker News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsDates the fixed build to July 2026.
  • GBHackersMaps the bug to CWE-287 Improper Authentication.
  • Help Net SecurityPasskeys could remain after the malicious app was removed.
  • The Hacker NewsNo exploitation reported; sign-in required; not in KEV.
CVEs
CVE-2026-80097
Vendors
Microsoft
Products
Microsoft AuthenticatorMicrosoft TeamsMicrosoft Graph
Organizations
Enclave

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Cyber Security NewsFirst report

    Android Authenticator flaw let apps steal work tokens

    An installed app with no permissions could impersonate Teams and obtain Graph tokens; fixed in 6.2606.4246.

  2. · 4d ago GBHackers

    Android Microsoft Authenticator flaw let apps steal account tokens

    CVE-2026-80097, scored 8.6, affects builds before 6.2606.4246; a zero-permission app could impersonate Microsoft apps.

  3. · 3d ago Help Net Security

    Microsoft Authenticator Android flaw let apps steal work tokens

    Versions before 6.2606.4246 are affected; Microsoft rated CVE-2026-80097 at CVSS 8.6 and shipped a fix on September 8, 2026.

  4. · 3d ago The Hacker News

    Authenticator for Android flaw let apps steal work tokens (CVE-2026-80097)

    Fixed in version 6.2606.4246; Microsoft says it was not used in attacks and rates exploitation less likely.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-80097
Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation
8.6<1%