Microsoft Authenticator flaw let permissionless Android apps take work sign-in tokens
Users should update Authenticator to version 6.2606.4246, since the fix does not say whether tokens already taken are revoked.
Microsoft has patched a flaw in its Authenticator app for Android that let a permissionless app impersonate trusted Microsoft apps such as Teams and obtain sign-in tokens for a victim's work account. Tracked as CVE-2026-80097 and rated 8.6 on the CVSS scale, it was fixed in Authenticator version 6.2606.4246, so users should update. Security researcher Ofek Levin, working through a fellowship at Enclave, found that the broker component trusted caller-supplied app identity and that its signature check, which compared against the impersonated app's genuine installed signature, passed. In testing, the stolen tokens gave access to mail, files and calendars, though Microsoft says exploitation needs a malicious app on the device and user participation in an authentication step, and that no attacks have been observed. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of October 26, 2026, and Microsoft's advisory does not say whether updating revokes tokens a malicious app may already have obtained.
Why it matters
The flaw put work accounts at risk on any Android phone that also had a malicious app installed, because the Authenticator broker trusted the identity a calling app claimed. Anyone whose phone had Microsoft apps installed could have had mail, files and calendars exposed without granting that app a single permission. Microsoft says exploitation needs user participation in a sign-in step and that no attacks have been seen, but the advisory leaves open whether earlier stolen tokens stay valid after the update.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.