Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Vulnerability / Mobile Security Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks. The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important." On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, and Authenticator hands back a token, a digital pass that proves the user is logged in. Because the broker controls access to the entire account, it should be careful about which app it grants a token to. The flaw let the wrong app get one. Authenticator exposes a component, an activity named AccountChooserActivity, that any app on the device can start. When the attacker's app started it, Authenticator built its token request from values the attacker's app supplied, including the name of the app it claimed to be. The app said it was Teams, and the broker believed it. A signature check was supposed to stop this, but it did not. The check looked up the real signature of the app being impersonated and confirmed the request matched it. Because Teams was genuinely installed on the device, its real signature was there to read, so the check passed. Authenticator could also see which app had actually made the request, Enclave found, but it did not use that to decide whether to hand over a token. In Enclave's tests, posing as Teams and requesting Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars, among others. Microsoft describes the result more generally: a successful attacker could authenticate as the signed-in user and reach that user's resources. The tokens apply to the work account signed into Authenticator on that device, not to other accounts. The two accounts disagree on one point a reader should weigh. Enclave reported that its proof of concept returned tokens without any user interaction, other than the presence of a signed-in account. Microsoft's advisory says exploitation requires installing a malicious app on the device and convincing the user to complete an authentication flow in Authenticator. Its CVSS score also indicates that the flaw requires user interaction. Microsoft says the flaw has not been exploited and was not publicly disclosed before the fix, and rates exploitation as "less likely." It was part of the company's September 2026 Patch Tuesday and was not one of the two Windows flaws flagged that month as already under attack. The vulnerability is not listed in the U.S. CISA Known Exploited Vulnerabilities catalog as of October 26, 2026. The fix is to update Microsoft Authenticator for Android to version 6.2606.4246 or later, as linked in Microsoft's advisory. Organizations that manage Android devices can require that minimum version through their device management. Microsoft's advisory gives the fix but does not say whether updating cancels any token a malicious app may already have obtained, so that remains unclear from the available sources. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.