Microsoft has addressed a critical vulnerability, identified as CVE-2026-80097, in its Authenticator application for Android. This flaw, with a CVSS score of 8.6, allowed malicious applications to acquire access tokens for work accounts without needing declared permissions, due to a flaw in the app’s authentication process.
Impact on Android Devices
The vulnerability, classified as a local elevation-of-privilege issue, particularly affected Android devices where Microsoft Authenticator was installed and logged into a work account. Researchers from Enclave discovered that an untrusted application could masquerade as a legitimate Microsoft app, such as Microsoft Teams, to request tokens from the Authenticator.
The exploit did not require user interaction, account credentials, or any special Android permissions beyond the app being installed. The core of the problem was an exported Android activity named com.microsoft.identity.client.AccountChooserActivity, which could be initiated by other apps present on the device.
Technical Details of the Flaw
The vulnerability arose from how Authenticator processed broker requests from other applications. These requests contained details like the app package name, client ID, redirect URI, and a caller UID. However, Authenticator failed to verify if the requesting app was genuinely the one it claimed to be.
Even though redirect URI validation was performed, it relied on the app identity claimed in the request. An attacker could claim to be Microsoft Teams, and if Teams was already installed, construct a valid redirect URI using its public package signature to pass the check. This loophole allowed the malicious app to be treated as a trusted entity.
Potential Risks and Mitigation
Successful exploitation could allow attackers to gain access to various Microsoft services, depending on the permissions requested. These could include access to Microsoft Graph resources such as emails, calendars, OneDrive files, SharePoint content, and more.
Microsoft has released an update for the Authenticator app, version 6.2606.4246, to patch this vulnerability. Users are strongly advised to update the app via Google Play to ensure their devices are secure. Organizations should verify that all managed devices are updated to the latest version.
Microsoft’s advisory emphasizes the need for mobile identity brokers to authenticate the actual calling application, considering its package identity, UID, and signing certificate. This incident underscores the importance of robust mobile security practices and timely application updates.
Organizations are encouraged to enforce strict mobile application controls, regularly update apps through MDM or EMM solutions, and restrict sideloaded applications. Security teams should stay vigilant for unusual Microsoft Graph activity and token use from unfamiliar devices, consulting Microsoft’s CVE-2026-80097 advisory for further guidance.
.webp?ssl=1 "E-commerce Sites Targeted by Malware Through Okendo Widget")