Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.

Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update.

In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.

The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important."

On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, and Authenticator hands back a token, a digital pass that proves the user is logged in. Because the broker controls access to the entire account, it should be careful about which app it grants a token to.

The flaw let the wrong app get one. Authenticator exposes a component, an activity named AccountChooserActivity , that any app on the device can start. When the attacker's app started it, Authenticator built its token request from values the attacker's app supplied, including the name of the app it claimed to be.

Source link