Microsoft Authenticator Flaw on Android Let Permissionless Apps Steal Work Account Tokens

Microsoft has fixed a vulnerability in its Authenticator app for Android. It let a malicious app that requests no permissions pose as a trusted Microsoft app, such as Teams, and obtain sign-in tokens for the victim's work account. The flaw is tracked as CVE-2026-80097, and the fix ships in Authenticator for Android version 6.2606.4246.

In the researchers' tests, the stolen tokens gave full access to the account's email, files, and calendar. According to Microsoft, exploitation also requires the victim to complete a sign-in step in Authenticator. The company has seen no attacks using the flaw.

Discovery and rating

The vulnerability was found by Ofek Levin, a participant in a fellowship program at security firm Enclave, which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, labeling it "Important."

How the attack worked

On Android, Authenticator does more than display six-digit codes. It also serves as an authentication broker. When Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, which returns a token, a digital pass proving the user is logged in. Because the broker controls access to the entire account, it has to be careful about which app receives a token.

Authenticator exposes a component, AccountChooserActivity, that any app on the device can launch. The token request was built from values supplied by the caller, including the name of the app it claimed to be. The malicious app said it was Teams, and the broker believed it.

A signature check did not prevent this. It looked up the genuine signature of the app being impersonated and matched the request against it. Because Teams was actually installed on the device, its signature was available, and the check passed. Enclave found that Authenticator could tell which app had really sent the request but did not use that information when issuing tokens.

In Enclave's tests, requesting Microsoft Graph tokens as Teams yielded permissions to read and send mail and to read and write files and calendars, among others. Microsoft describes the impact more broadly: an attacker could authenticate as the signed-in user and reach that user's resources. Only the work account signed into Authenticator on that device is affected.

Conflicting accounts

Enclave says its proof of concept obtained tokens with no user interaction beyond the presence of a signed-in account. Microsoft's advisory says exploitation requires installing a malicious app and getting the user to complete an authentication flow in Authenticator. Its CVSS score also assumes user interaction.

Microsoft says the flaw was not exploited or publicly disclosed before the fix and rates exploitation as "less likely." The fix was part of the September 2026 Patch Tuesday. The vulnerability is not one of the two Windows flaws already under attack that month. As of October 26, it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Users should update Authenticator for Android to version 6.2606.4246 or later. Organizations can enforce that minimum version through device management. Microsoft does not say whether updating revokes any tokens a malicious app may have already obtained.

Source: The Hacker News