Patched Android Authenticator Flaw Let Permissionless Apps Steal Work Tokens
A flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated 8.6 by Microsoft, let a malicious app with no permissions impersonate trusted apps such as Teams and obtain tokens for the signed-in work account. Researchers demonstrated access to email, files, calendars, and Teams chats; Microsoft says it has found no evidence of exploitation. Update the app to version 6.2606.4246 or later.
What happened
A flaw in Microsoft Authenticator for Android let a malicious app with no permissions impersonate trusted Microsoft apps, such as Teams, and steal sign-in tokens for the work account connected in Authenticator. Researchers demonstrated that the stolen tokens granted access to email, files, calendars, and Teams chats. Microsoft has fixed the issue.
Why it matters
Employees using Authenticator on Android with a work account were the target. According to the researchers, the stolen tokens granted access to email (including sending messages), files in Microsoft services, calendars, Teams chats, and authentication methods and passkey management. With a work account already signed in, the researchers report no further user interaction was needed.
What to do
Update Microsoft Authenticator for Android to version 6.2606.4246 or later on all devices. Check whether managed devices still run versions earlier than 6.2606.4246.
For the technical team
- CVE
- CVE-2026-80097
- Affected
- Microsoft Authenticator (Android) · Microsoft Authenticator for Android versions before 6.2606.4246; work accounts signed into the app.
- Exploitation
- No exploitation reported; Microsoft says it has found no evidence of exploitation. Researchers demonstrated token theft in tests (proof-of-concept stage).
- Fix
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- Vector
- Microsoft Authenticator for Android trusted identity information supplied by the requesting app instead of confirming which app actually made the request. A malicious app with no permissions could impersonate a trusted Microsoft app, such as Teams, and request tokens for the work account signed into Authenticator. According to Microsoft, exploitation requires a malicious app on the device and user interaction during authentication; researchers reported obtaining tokens without further interaction when a work account was already signed in.
- More details
- Tracked as CVE-2026-80097 and rated 8.6 by Microsoft. Stolen tokens provided access to email (including sending messages), files in Microsoft services, calendars, Teams chats, and authentication methods and passkey management.
Timeline
New detail: researchers demonstrated the stolen tokens granted access to email, files, calendars and Teams chats.
Flaw tracked as CVE-2026-80097; fix available in Authenticator for Android version 6.2606.4246.
Researchers detail a Microsoft Authenticator for Android flaw that Microsoft has already patched.
Sources 3 sources
- @TheHackersNews @TheHackersNews
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens The Hacker News
- @DarkWebInformer @DarkWebInformer
