Microsoft Fixes Android Authenticator Flaw That Could Expose Work Account Tokens
Summary
CVE-2026-80097 let a permissionless Android app impersonate a trusted app to obtain Microsoft Authenticator work-account tokens. Microsoft says exploitation requires user interaction and has not occurred; update Authenticator to version 6.2606.4246 or later.
Key points
- The flaw affected Microsoft Authenticator for Android and is tracked as CVE-2026-80097, rated 8.6 (Important) by Microsoft.
- Enclave found that any app could start AccountChooserActivity and supply a trusted app name, such as Teams, in a token request.
- In Enclave's tests, Microsoft Graph tokens could grant access to work-account email, files, and calendars.
- Enclave reported its proof of concept returned tokens without user interaction beyond having a signed-in account; Microsoft says exploitation requires the user to complete an authentication flow.
- Microsoft says the flaw has not been exploited and was not publicly disclosed before the fix.
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later; organizations can enforce the minimum version through device management.
- Microsoft's advisory does not clarify whether updating invalidates tokens a malicious app may already have obtained.
Article Details
- Vulnerability Types
- Token-broker app impersonation allowing unauthorized token issuance
- Severity
- CVSS 8.6; Microsoft rated it "Important."
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- Organizations managing Android devices can require version 6.2606.4246 or later.
MITRE ATT&CK
CVE
People
Vendors
Products
Microsoft AuthenticatorThe fix is to update Microsoft Authenticator for Android to version 6.2606.4246 or later, as linked in Microsoft's advisory. Organizations that manage Android devices can require that minimum version through theirMicrosoft GraphIn Enclave's tests, posing as Teams and requesting Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars, among others.TeamsMicrosoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.