Microsoft Authenticator Android flaw let rogue apps steal work account access

Researchers at Enclave found a flaw in Microsoft Authenticator for Android that let any app on a phone quietly take over a work account. The app did not need permissions, and the user did not need to tap anything. Microsoft fixed the issue, tracked as CVE-2026-80097.

How the flaw worked

On Android, Authenticator acts as a broker for Microsoft apps such as Teams and Outlook. When an app needs sign-in, it asks Authenticator for a token, and Authenticator is supposed to check carefully which app is asking. Researcher Ofek Levin found that one part of Authenticator could be opened by any app, and it trusted what the app said about itself instead of verifying the caller. Authenticator also ran a check, but that check could be faked because any app can read the details it compared.

What attackers could do

With one work account signed into Authenticator, a test app obtained tokens that could read and send email, read and change files, calendar entries and SharePoint sites, and send Teams messages as the victim. By pretending to be Authenticator itself, an attacker could also change the account's sign-in methods, including creating and deleting passkeys. An attacker who adds a passkey could keep access after the malicious app is removed. The attack still required a malicious app on the device, so someone would need to be tricked into installing it, but the theft was silent once it happened.

Fixed versions and advice

Enclave reported the flaw to Microsoft through responsible disclosure. Microsoft confirmed it and released a fix published on September 8, 2026, with a CVSS score of 8.6. All Authenticator for Android versions before 6.2606.4246 are affected. Users should update from Google Play Store and check they are on version 6.2606.4246 or later. Organizations that manage company devices should make sure their MDM enforces that minimum version. Users should also be careful about sideloading apps or installing unfamiliar ones from outside trusted stores.

Sources: Help Net Security · Techmeme