Microsoft has fixed a vulnerability in Authenticator for Android that could let a malicious app obtain authentication tokens and access resources as the affected user. Research described by The Hacker News demonstrated access to a work account’s email, files and calendar, though Microsoft’s advisory specifies a user authentication step as a prerequisite for exploitation.
The flaw, CVE-2026-80097, involves improper authentication and is rated Important by Microsoft. The company published its advisory on September 8, 2026, and corrected the fix build number on September 15. According to The Hacker News, the fixed release is Microsoft Authenticator for Android version 6.2606.4246, and users should update to that version or later.
Technical details were published on October 23 by Enclave, following research by Ofek Levin through the security firm’s fellowship program, The Hacker News reported. Microsoft credits Levin and Enclave in its advisory.
Authenticator can act as a sign-in broker for other Microsoft apps: an app requests authentication, and the broker returns a token that lets it access the user’s resources. The reported flaw allowed a malicious app with no permissions to impersonate a trusted Microsoft app in that exchange.
According to The Hacker News’ account of Enclave’s findings, the malicious app could launch an exposed Authenticator component named AccountChooserActivity. Authenticator then built a token request using attacker-supplied values, including the identity of the app being impersonated.
A signature check failed to establish which app had actually made the request. In the researchers’ Teams example, it checked against the genuine Teams signature available because Teams was installed on the device. Authenticator could identify the actual requesting app, the researchers found, but did not use that information to decide whether to release a token.
In Enclave’s tests, impersonating Teams and requesting Microsoft Graph tokens yielded permissions to read and send mail, read and write files, and read and write calendars, among others. The reported scope was the work account signed into Authenticator on that device, rather than other accounts.
The accounts differ on user interaction. Enclave reported that its proof of concept returned tokens with no interaction beyond having an account signed in. Microsoft’s advisory says an attacker must install and run a malicious application on an affected Android device and convince the user to complete an authentication flow in Authenticator.
Microsoft recorded the vulnerability as neither publicly disclosed nor exploited at the time of its original advisory and assessed exploitation as less likely. The demonstrated access is a research result, not evidence of an attack against users. Updating addresses the flaw, but the available evidence does not establish whether an update invalidates tokens a malicious app may already have obtained.
