Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,
Microsoft has patched a security flaw in its Authenticator app for Android that allowed malicious apps without permissions to impersonate trusted Microsoft apps and steal work account tokens. The vulnerability, tracked as CVE-2026-80097, was fixed in Authenticator version 6.2606.4246. Researchers from Enclave demonstrated that the flaw could grant attackers full access to a user's email, files, and calendar if they completed the sign-in process in Authenticator.
The flaw existed due to a component in Authenticator that any app could start, allowing attackers to manipulate the request for a token. Microsoft rated the vulnerability as important, but acknowledged it required user interaction and had not been exploited in the wild. The fix involves updating the app to the latest version, though it's unclear if existing tokens obtained through the vulnerability would be revoked upon update.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
