Microsoft has addressed a vulnerability in its Authenticator app for Android that permitted unauthorized apps to impersonate trusted Microsoft applications, such as Teams, and collect authentication tokens from a user’s work account. Users should update to the latest version to protect their accounts.
Technical Details and Impact
The flaw, identified as CVE-2026-80097, was resolved in the Android version 6.2606.4246 of the Authenticator app. Security researchers from Enclave highlighted how the vulnerability allowed full access to email, files, and calendar data. It required user interaction to exploit, as the user needed to complete a sign-in process in the Authenticator app.
Researcher Ofek Levin, associated with Enclave, disclosed the technical aspects on October 23, 2026, following Microsoft’s CVE assignment on September 8. With a CVSS score of 8.6, Microsoft deemed the issue as ‘Important.’ The flaw arose because the Authenticator app could be misled by a malicious app initiating the AccountChooserActivity component, allowing the deceptive app to receive tokens.
Exploitation and Mitigation
The vulnerability allowed the malicious app to masquerade as an application like Teams, exploiting the system to bypass expected security checks. Although a signature check existed to verify the app’s identity, the presence of the genuine app’s signature on the device enabled the wrongful validation.
Enclave’s tests demonstrated that posing as Teams could yield permissions like reading and sending emails, and accessing files and calendars. While Microsoft stated that user interaction was necessary for exploitation, Enclave reported that proof-of-concept attacks could obtain tokens without further user input beyond having an active account.
Microsoft’s Response and Recommendations
Microsoft confirmed that the flaw had not been exploited in real-world attacks and emphasized the importance of updating to the latest app version. The fix was part of the September 2026 Patch Tuesday updates, and Microsoft assessed the likelihood of exploitation as low. The flaw was not included in the CISA Known Exploited Vulnerabilities catalog as of late October 2026.
Microsoft advises users to ensure their Authenticator app is updated to version 6.2606.4246 or later. Organizations managing Android devices should enforce this update as a minimum requirement. However, Microsoft’s advisory did not specify if updating the app would invalidate any tokens obtained by malicious means.
The correction of this vulnerability underscores the necessity for users to maintain updated applications to safeguard against potential security threats.
