Cybersecurity
Microsoft fixes Android Authenticator token flaw
Microsoft patched a flaw in Authenticator for Android that let a malicious app impersonate another Microsoft app and obtain work-account tokens, though the company said exploitation still needed user action.
- Microsoft patched CVE-2026-80097 in Microsoft Authenticator for Android version 6.2606.4246.
- Enclave said the flaw let another app trigger Authenticator and supply the name of a Microsoft app, which could lead to a token being issued for the wrong app.
- In Enclave's tests, posing as Teams and requesting Microsoft Graph tokens returned access to mail, files and calendars.
- Microsoft said exploitation also required the victim to complete an authentication flow in Authenticator, and said it had not seen the flaw used in attacks.
Microsoft said it had fixed CVE-2026-80097 in Microsoft Authenticator for Android, and advised users to move to version 6.2606.4246 or later. The research was published by Enclave on 23 October 2026, and Microsoft had assigned the CVE on 8 September with an 8.6 score that it classed as Important.
On Android, Authenticator also acted as a sign-in broker for Microsoft apps. Enclave said the flaw let any app start AccountChooserActivity and provide details that made the request look as if it came from Teams or another trusted Microsoft app.
The check that was meant to stop impersonation compared the request with the genuine signature of the app being imitated. Because Teams was installed on the device, that signature was available and the check passed; Enclave also said Authenticator could see the real caller but did not use that information.
In Enclave's tests, requests made as Teams returned Microsoft Graph tokens with permissions to read and send mail, and to read and write files and calendars. Microsoft said a successful attacker could authenticate as the signed-in user and reach that user's resources, but that the tokens applied only to the work account on the device.
Enclave said its proof of concept returned tokens without any user interaction beyond the presence of a signed-in account. Microsoft said exploitation required installing a malicious app and persuading the user to complete an authentication flow, and said the flaw had not been publicly disclosed before the fix or listed in CISA's catalog as of 26 October 2026.
Named in this story
People
- Ofek Levin
- the researcher who found the issue through a fellowship at Enclave
Companies
- Microsoft
- patched the flaw and issued the advisory
- Enclave
- the security firm that published the technical details
Governments and agencies
- U.S. CISA
- its Known Exploited Vulnerabilities catalog did not list the flaw as of 26 October 2026
Products and systems
- Microsoft Authenticator
- the Android app that brokered sign-ins and contained the flaw
- CVE-2026-80097
- Microsoft's identifier for the vulnerability
- Teams
- the Microsoft app used as the impersonated identity in tests
- Outlook
- another Microsoft app named as a sign-in client
- Microsoft Graph
- the service for which Enclave said it obtained tokens in testing
How the source tells it
The piece is a restrained security warning, with urgency created by the patch-and-update framing rather than by overt hype.
- urgency the story repeatedly directed users and administrators to move to a minimum fixed version
- alarm it described a malicious app obtaining tokens that could open mail, files and calendars