CVE-2026-80097 — fixed in Microsoft Authenticator for Android version 6.2606.4246 — allowed a malicious, permissionless Android app to pose as a trusted Microsoft app and collect sign‑in tokens for a victim’s work account.
How the vulnerability operated inside Authenticator
On Android, Microsoft Authenticator functions as more than a six‑digit code generator: it acts as a broker that hands tokens to other Microsoft apps such as Teams and Outlook when they request a user’s sign‑in. The broker exposes an activity named AccountChooserActivity that any app on the device can start. According to Enclave’s analysis, Authenticator built its token request from values supplied by the calling app — including the name of the app the caller claimed to be — and then trusted that supplied identity.
A signature check intended to block impersonation failed because it compared the impersonated app’s real signature — which was present on the device when the genuine app (for example, Teams) was installed — rather than verifying which app had actually initiated the request. Enclave also found that Authenticator could see the real calling app but did not use that information to decide whether to hand over a token.
What Enclave’s tests returned and the disagreement with Microsoft
The technical research, authored by Ofek Levin while working through a fellowship program at the security firm Enclave, showed that an attacker that successfully posed as Teams and requested Microsoft Graph tokens could receive permissions to read and send mail, read and write files, and read and write calendars, among others. Enclave reported that its proof‑of‑concept returned tokens without any user interaction other than the presence of a signed‑in account.
Microsoft’s advisory describes the outcome more broadly — an attacker could authenticate as the signed‑in user and reach that user’s resources — but it states exploitation also requires installing a malicious app on the device and convincing the user to complete an authentication flow in Authenticator. Microsoft’s advisory says the flaw has not been used in attacks, was not publicly disclosed before the fix, and rates exploitation as “less likely.”
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadMicrosoft’s timeline, severity rating, and remediation
Microsoft assigned the vulnerability CVE‑2026‑80097 on September 8 and rated it 8.6 on the CVSS scale, labeling that score “Important.” The company included the fix in its September 2026 Patch Tuesday. Microsoft says the issue is fixed in Authenticator for Android version 6.2606.4246; users of the app are advised to update to that version or later.
Microsoft also notes that the flaw was not one of the two Windows flaws flagged that month as already under attack, and the vulnerability was not listed in the U.S. CISA Known Exploited Vulnerabilities catalog as of October 26, 2026. The company’s advisory does not state whether updating Authenticator cancels any tokens a malicious app may already have obtained, leaving that point unclear in the available advisories.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Verify that managed Android devices run Microsoft Authenticator version 6.2606.4246 or later; device management systems can enforce that minimum version. Teams should also review brokered sign‑in flows where a central app vends tokens to other applications.
- Procurement and enterprise IT leaders: Because the tokens applied to the work account signed into Authenticator on the device — not to other accounts — organizations should prioritize devices tied to corporate credentials for immediate remediation and inventory checks.
- End users and device owners: Update Microsoft Authenticator for Android to version 6.2606.4246 or later. Microsoft’s advisory emphasizes that exploitation requires both installation of a malicious app and completion of an authentication flow in Authenticator.
Closing observation and remaining question
The vulnerability exposed a broker logic error: Authenticator trusted caller‑supplied identity strings while validating only the presence of an installed app’s signature on the device. Microsoft has patched that logic with an update, and the company rates exploitation as “less likely” and says it has seen no evidence of active exploitation. One concrete question remains in the public record: Microsoft’s advisory supplies the fix but does not say whether updating cancels any token a malicious app may already have obtained — a detail that matters to organizations seeking to know whether they must revoke existing credentials.
Original reporting: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
