Microsoft Authenticator Android Flaw Lets Apps Steal Work Tokens
Microsoft has released a patch for a flaw in its Authenticator app for Android that allowed a malicious application with no declared permissions to impersonate a trusted Microsoft app, such as Teams, and retrieve sign-in tokens for a victim’s work account. The vulnerability is tracked as CVE-2026-80097 and was fixed in Authenticator for Android version 6.2606.4246. All users of the app should install the update immediately.
Attack Path
On Android, Authenticator acts as a broker between Microsoft applications and the user’s work account. When an application such as Teams or Outlook needs to sign a user in, it launches Authenticator, which then returns a token that proves the user is authenticated. The flaw lies in Authenticator’s exposed component, an activity named AccountChooserActivity. Any application on the device can start this activity. The attacker’s app supplies values to the activity, including the name of the app it claims to be. Authenticator builds a token request from those values and, due to a missing signature verification step, accepts the request. The check that was intended to compare the real signature of the impersonated app with the supplied signature failed because the real signature of the genuine Teams app was available on the device, allowing the check to pass. Authenticator also had visibility into which application actually made the request but did not use that information to gate token issuance.
Permissions Gained
Enclave’s tests showed that impersonating Teams and requesting Microsoft Graph tokens returned scopes that allowed the attacker to read and send mail, read and write files, and read and write calendars. Microsoft describes the result more generally: a successful attacker could authenticate as the signed-in user and access that user’s resources. The tokens apply to the work account signed into Authenticator on the device.
Evidence and Confirmation
The flaw was discovered by Ofek Levin of Enclave, who published technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated the vulnerability 8.6 on the CVSS scale, labeling it “Important.” Microsoft states that exploitation also requires the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks to date.
Mitigation Steps
- Update Authenticator – Install Authenticator for Android version 6.2606.4246 or later.
- Restrict App Permissions – Review installed applications for unnecessary permissions, especially those that can start activities.
- Monitor Token Requests – Enable logging for token issuance events in Authenticator to detect anomalous requests.
- Audit Signature Checks – Verify that broker services enforce strict signature verification before issuing tokens.
What to Watch Next
The vulnerability highlights the risk of exposing broker components without adequate authentication checks. Organizations should audit their mobile security posture, ensuring that only trusted applications can invoke sensitive broker services. Microsoft’s response to the flaw suggests that similar issues may exist in other brokered authentication flows.
For further technical context, see the Zero-Day Vulnerability & CVE Exploit Matrix.
Related coverage
- Microsoft 365 Token Replay Attack Compromises 79 Organizations
- OVHcloud GitHub Compromise Reveals GlassWorm Activity