Microsoft has released a security update for its Authenticator app on Android after researchers showed a malicious, permissionless application could pose as a trusted Microsoft app and collect sign‑in tokens for a work account.
What happened
The flaw, tracked as CVE-2026-80097, was fixed in Authenticator for Android version 6.2606.4246. Microsoft assigned the CVE on Sept. 8 and rated the vulnerability 8.6 on the CVSS scale, which it calls “Important.” Security firm Enclave published technical details on Oct. 23, attributing the research to Ofek Levin, who worked through a fellowship program at the company.
How the exploit worked
On Android, Authenticator performs more than one‑time codes. When a Microsoft app such as Teams or Outlook needs to sign a user in, those apps ask Authenticator for a token. Authenticator acts as a broker, issuing a token that proves the user is logged in and that other apps can use to access email, files and calendar data.
Enclave found that Authenticator exposed a component named AccountChooserActivity that any app on the device could start. When a malicious app launched that activity, Authenticator built a token request using values supplied by the requesting app, including the name of the app it claimed to be. The attacking app declared itself to be Teams and Authenticator accepted the claim.
- The broker attempted a signature check, but because the real Teams app was genuinely installed on the device, its signature could be read and the check passed.
- Authenticator could identify which app had actually made the request, but it did not use that information to decide whether to hand over a token.
- In Enclave’s tests, tokens obtained this way gave full access to the account’s email, files and calendar.
Vendor response and mitigation
Microsoft says exploitation also requires the user to complete a sign‑in step in Authenticator, and that the company has no evidence the flaw has been used in active attacks. The company released the patch in the specified app version and advises anyone using Authenticator for Android to update immediately.
Enclave’s disclosure included technical analysis and demonstration testing. The firm published its findings to explain the root cause and the steps attackers could use to abuse the exposed activity, and Microsoft implemented fixes to address how Authenticator validates requests and decides which app should receive tokens.
What users and IT teams should do
- Update Authenticator for Android to version 6.2606.4246 or later.
- IT administrators should monitor sign‑in logs and device inventories for unusual token activity and ensure mobile device management policies are applied.
This vulnerability highlights the role Authenticator plays beyond one‑time passwords: as a broker that, if misconfigured, can expose broad account access. Microsoft’s patch closes the specific avenue Enclave reported while underscoring the need for careful validation of interapp authentication flows on Android.
