{
  "id": 16743432,
  "title": "Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens",
  "url": "https://urgent.news/2026/10/27/microsoft-authenticator-flaw-let-permissionless-android-apps-steal",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T12:09:50.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html"
  },
  "original_language": "en",
  "account": "Microsoft has patched a security flaw in its Authenticator app for Android that allowed malicious apps without permissions to impersonate trusted Microsoft apps and steal work account tokens. The vulnerability, tracked as CVE-2026-80097, was fixed in Authenticator version 6.2606.4246. Researchers from Enclave demonstrated that the flaw could grant attackers full access to a user's email, files, and calendar if they completed the sign-in process in Authenticator. The flaw existed due to a component in Authenticator that any app could start, allowing attackers to manipulate the request for a token. Microsoft rated the vulnerability as important, but acknowledged it required user interaction and had not been exploited in the wild. The fix involves updating the app to the latest version, though it's unclear if existing tokens obtained through the vulnerability would be revoked upon update.",
  "summary": "Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,",
  "key_points": [
    "Microsoft patched Authenticator flaw allowing permissionless apps to steal work tokens.",
    "Vulnerability CVE-2026-80097 fixed in version 6.2606.4246.",
    "Researchers demonstrated flaw granting full access to user's email, files, and calendar."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}