# Microsoft Authenticator Flaw Let Android Apps Steal Work Login Tokens

- URL: https://usa-24.com/microsoft-authenticator-vulnerability-android/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-26T21:37:48.474Z
- Updated: 2026-10-26T21:37:48.482Z
- Topics: Microsoft Authenticator, Android Security, Token Theft, CVE-2026-80097, Microsoft 365

> Researchers at Enclave showed a patched Microsoft Authenticator flaw on Android let a zero-permission app impersonate Teams and obtain work-account tokens. Update to 6.2606.4246 or later.

## Key takeaways

- Microsoft fixed CVE-2026-80097, a flaw in Microsoft Authenticator for Android, in version 6.2606.4246 and later.
- A malicious app with zero Android permissions could impersonate Microsoft Teams and obtain delegated tokens for a signed-in work account.
- In Enclave's tests, the stolen tokens reached Microsoft Graph services including email, files and calendars.
- The flaw carries a CVSS score of 8.6, and the CVE record lists a September 8, 2026 publication date.
- No source reviewed for this story confirms in-the-wild exploitation or a CISA Known Exploited Vulnerabilities listing.

A Microsoft Authenticator vulnerability on Android let a malicious app with zero permissions impersonate Microsoft Teams and obtain delegated tokens for a signed-in work account. The flaw is tracked as CVE-2026-80097 and carries a CVSS score of 8.6. Researchers at Enclave published their technical report on October 23, 2026, and coverage has continued through this week.

The news is not a new patch. Microsoft fixed the bug during its September update cycle, and the CVE record lists a publication date of September 8, 2026 [4]. What changed is that the mechanics are now public, which matters most for anyone still running an older build.

Authenticator is a two-factor app that work and personal users rely on. According to [Cryptika](https://www.cryptika.com/microsoft-authenticator-flaw-lets-malicious-android-apps-steal-account-tokens-with-zero-permissions/) [5], this flaw targeted the token broker the app uses for Microsoft sign-ins. A valid token can act for the signed-in user, which is why the reach of this bug matters beyond a single app.

## The Microsoft Authenticator vulnerability, explained

The weakness sat in how Authenticator handled requests from other apps. [RuntimeWire's account of Enclave's findings](https://runtimewire.com/article/enclave-authmask-microsoft-authenticator-android-token-flaw) [1] describes a design problem as much as a coding slip. The component trusted information supplied by the caller when it had the means to verify who the caller was.

That pattern is worth noticing for developers of other apps that expose sign-in components to the rest of the phone. For users, the practical question is simpler: which builds are exposed, and what does an attacker need to succeed.

## How a zero-permission Android app gets in

Security researcher Ofek Levin, working through Enclave's fellowship program, found the weakness in an exported Android activity named com.microsoft.identity.client.AccountChooserActivity. Because the activity was exported, any app installed on the same Android device could call it. [Cyber Press](https://cyberpress.org/microsoft-authenticator-flaw/) [2] described the same mechanics.

The activity accepted key identity fields directly from attacker-controlled intent extras. Those fields included the claimed package name, client ID, redirect URI, requested scopes and caller UID. Authenticator could identify the genuine calling app through Android's calling-activity mechanism, but it did not use that verified identity to make its authorization decision. In practice, the component could see who was calling and still trusted what the caller claimed about itself.

The attack had conditions. Authenticator had to be installed with an authenticated work account, and a malicious app had to be on the same phone, according to the CVE record summary [4]. The malicious app needed no Android permissions. Apps that request nothing give users no permission prompt to question at install time, which is what makes this flaw unusual.

In Enclave's tests, the tokens reached Microsoft Graph services including email, files and calendars [1]. Those are the services a typical employee uses all day, so a successful theft would reach well beyond a single login screen.

## Which Authenticator versions are affected

[GBHackers](https://gbhackers.com/microsoft-authenticator-flaw/amp/) [3] describes the flaw as affecting Android phones on Authenticator builds earlier than the fix. The summary below collects the key dates and versions.

| Item | Detail |
|---|---|
| CVE | CVE-2026-80097 |
| Severity | CVSS 8.6, high |
| Vulnerable | Authenticator for Android earlier than 6.2606.4246 |
| Fixed | 6.2606.4246 and later |
| CVE record published | September 8, 2026 |
| Technical report | October 23, 2026 |

A secondary CVE summary also lists an Android affected range of 6.0.0 to below 16.3.0 [4]. That range uses different version numbering from the 6.2606.4246 build. The simplest rule is to install the fixed build or anything newer, rather than trying to match the range.

Do not confuse this flaw with CVE-2026-41615, a separate Authenticator token-theft bug with a CVSS score of 9.6. Microsoft patched that one in May, and it affected both Android and iOS. The fixed builds were Android 6.2605.2973 and iOS 6.8.47 or later [6].

The sources reviewed for CVE-2026-80097 describe only the Android app, so iOS status for this flaw is unconfirmed.

## How to update Microsoft Authenticator on Android

The fix takes a few minutes. Anyone who uses Authenticator on Android for work or personal accounts should work through these steps:

1. Open the Google Play Store, search for Microsoft Authenticator, and install any update that is listed.
2. Open the app's settings and confirm the version reads 6.2606.4246 or later.
3. Remove apps you do not recognize, especially any recently sideloaded app that came from outside the Play Store.
4. Review app permissions and revoke any access a utility app does not need.

The last two steps are checks, not shields. A zero-permission app can still be malicious, so the update is the step that closes this specific gap. Permission review helps catch the rest.

## What IT admins should check on managed phones

Security teams running Android fleets have three priorities. First, block sideloading on managed devices, since this attack depends on a second app sitting on the same phone. Second, confirm that every managed device runs Authenticator 6.2606.4246 or later.

Third, review Microsoft Graph sign-in activity that you cannot account for, as one write-up recommends [4]. Unexpected token use is the signal that would show up if someone had already tried this method against your users.

## What remains unconfirmed

Several gaps remain. No source reviewed for this story confirms in-the-wild exploitation of CVE-2026-80097, and none reports a listing in CISA's Known Exploited Vulnerabilities catalog. Treat the flaw as a documented, patched method rather than a confirmed active campaign for now.

Coverage also does not say how many organizations or users were exposed. Enclave's full write-up was not read directly, so the technical details here come through secondary coverage. Microsoft's own advisory text was not retrieved, and the CVE summary comes from a secondary site.

## Why this lands in a week of AI-speed patching

The same week brought a sharp example of how quickly disclosure now moves. Fortinet shipped AI-assisted fixes for FortiOS, FortiManager and FortiAnalyzer on October 21 and 22, but withheld CVE IDs until November 10 [7][8][9]. Fortinet CISO Carl Windsor wrote that "the window between disclosure and exploitation continues to shrink" [8].

The Authenticator case shows the same squeeze from the other side. The fix arrived in September, the technical details came out October 23, and anyone still running an older build now has a written method to study. USA 24 has covered similar pressure elsewhere, including a [BeyondTrust zero-day that China-linked hackers exploited for seven weeks](https://usa-24.com/beyondtrust-zero-day-cve-2026-102764/), and [Cathedral's account of AI agents reaching Anthropic's internal systems in 12 hours](https://usa-24.com/cathedral-anthropic-breach-ai-agents/). Token theft is also the thread in a [Gheist campaign that used stolen GitHub tokens to dump repository secrets](https://usa-24.com/github-gheist-campaign-stolen-tokens/).

## What to watch next

Three developments will clarify how serious this becomes. Microsoft's own advisory and CVE entry should confirm the affected scope and state whether exploitation has been observed. Enclave's full report will show how much of the method others can reproduce. A listing in CISA's catalog would move the flaw from a documented bug to an active threat.

Until then, the answer for users is direct. A phone running Authenticator 6.2606.4246 or later is patched against this method, and an older one is not.

## Frequently asked questions

### Is Microsoft Authenticator safe to use on Android right now?

Microsoft fixed CVE-2026-80097 in Authenticator 6.2606.4246 and later, so updated versions are protected against this method. Phones on older builds are exposed, because Enclave's technical report on October 23 made the attack details public. Keep using the app, but install the update first.

### Which Microsoft Authenticator versions are vulnerable to CVE-2026-80097?

Authenticator for Android builds earlier than 6.2606.4246 are vulnerable, according to the CVE summary and GBHackers. The sources reviewed describe only the Android app, so iOS status is unconfirmed. Check the version in the app's settings after updating.

### Has CVE-2026-80097 been used in real attacks?

No source reviewed for this story confirms in-the-wild exploitation, and none reports a CISA Known Exploited Vulnerabilities listing. Coverage also does not say how many users or organizations were exposed. Treat the flaw as a documented risk that needs patching now.

### How is CVE-2026-80097 different from CVE-2026-41615?

CVE-2026-80097 is the zero-permission Android flaw that let a malicious app impersonate Teams, with a CVSS score of 8.6. CVE-2026-41615 is a separate token-theft flaw with a CVSS score of 9.6 that Microsoft patched in May for Android and iOS. Its fixed builds were Android 6.2605.2973 and iOS 6.8.47 or later.

## Sources

1. [Enclave details patched Authenticator flaw that let Android apps impersonate Teams](https://runtimewire.com/article/enclave-authmask-microsoft-authenticator-android-token-flaw)
2. [Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Login Tokens Without Permissions](https://cyberpress.org/microsoft-authenticator-flaw/)
3. [Microsoft Authenticator Flaw Allows Android Apps With Zero Permissions to Steal Authentication Tokens](https://gbhackers.com/microsoft-authenticator-flaw/amp/)
4. [CVE-2026-80097: Update Microsoft Authenticator for Android to Block Work Token Theft](https://windowsforum.com/news/cve-2026-80097-update-microsoft-authenticator-for-android-to-block-work-token-theft.450026/)
5. [Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions](https://www.cryptika.com/microsoft-authenticator-flaw-lets-malicious-android-apps-steal-account-tokens-with-zero-permissions/)
6. [Microsoft Patches Critical Token Theft Vulnerability in Authenticator App](https://beyondmachines.net/event_details/microsoft-patches-critical-token-theft-vulnerability-in-authenticator-app-s-1-5-s-d/gD2P6Ple2L)
7. [Fortinet Patches AI-Found Flaws in FortiOS, FortiManager](https://www.cyberkendra.com/2026/10/fortinet-frontier-ai-fortios-patches.html)
8. [Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer](https://securityonline.info/fortinet-security-updates-fortios-ai-flaws/)
9. [Fortinet Patches AI-Found Flaws 3 Weeks Before CVE Details](https://aitoolsrecap.com/Blog/fortinet-ai-found-flaws-patched-before-cve-details-2026)