Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no special permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim’s work account. Microsoft tracks it as CVE-2026-80097 and rates it 8.6 on the CVSS scale (“Important”). The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published technical details on October 23. In Enclave’s tests the tokens gave access to the account’s email, files, and calendar.
On Android, Authenticator acts as a broker: when Teams or Outlook needs to sign a user in, it asks Authenticator, which hands back a token. Enclave found that Authenticator exposes a component that any app on the device can launch, and builds its token request from values the calling app supplies, including the name of the app it claims to be. The signature check meant to stop impersonation looked up the real signature of the claimed app (genuinely installed on the device) and compared it with the claim, so it passed. The tokens apply to the work account signed into Authenticator on that device.
The sources disagree on one point. Enclave said its proof of concept returned tokens without any user interaction beyond a signed-in account being present. Microsoft’s advisory says exploitation requires installing a malicious app and convincing the user to complete an authentication flow in Authenticator. Microsoft says the flaw was not publicly disclosed before the fix, has not been exploited, and rates exploitation “less likely”. The Hacker News reported it was part of the September 2026 Patch Tuesday and was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26. Microsoft’s advisory does not say whether updating cancels tokens a malicious app may already have obtained.
How to check if you’re affected
Affected products are Microsoft Authenticator for Android installs on versions older than 6.2606.4246, on devices where a work account is signed in. Update Authenticator through the Play Store to version 6.2606.4246 or later, as linked in Microsoft’s advisory. Organizations that manage Android devices can enforce that minimum version through their device management tooling. Be cautious about sideloaded or unfamiliar apps on devices that hold a work account, since exploitation needs a malicious app to be installed.