Microsoft Authenticator flaw let any Android app grab work tokens

A flaw in Microsoft Authenticator for Android let any installed app — with no special permissions — obtain OAuth tokens for the work account signed into Authenticator on the device. The bug, CVE-2026-80097, is an improper-authentication issue in Authenticator's role as an authentication broker. Microsoft rated it 8.6 CVSS and "Important," assigned it on 8 September 2026, and shipped the fix in Authenticator for Android version 6.2606.4246. Security firm Enclave published the technical details on 23 October, reported by The Hacker News.

What the bug does

Authenticator brokers sign-in for other Microsoft apps. Enclave, where researcher Ofek Levin found the issue through a fellowship, showed that the exported AccountChooserActivity component could be launched by any app on the device. The caller names the app it claims to be — say, Teams — and Authenticator issued tokens on that claim. A signature check was supposed to block impersonation, but it validated against the real signature of the impersonated app, which is readily available if that app is installed, so the check passed. Authenticator could identify the actual caller but did not use that to decide whether to mint a token.

In Enclave's tests the tokens reached mail, files, and calendars through Microsoft Graph. The access is scoped to the work account signed into Authenticator on that handset.

Exploitation status

Microsoft says the flaw was not exploited and not publicly disclosed before the fix, and rates exploitation "less likely." It is not in CISA's KEV catalog as of 26 October. The two accounts disagree on user interaction, and the gap matters for your risk model:

• Enclave reports its proof of concept returned tokens with no user interaction beyond a signed-in account being present.
• Microsoft's advisory says exploitation requires installing a malicious app and convincing the user to complete an authentication flow in Authenticator, and its CVSS vector marks user interaction as required.

Microsoft's advisory also does not state whether updating revokes tokens a malicious app may already have taken.

Action checklist

1. Push Authenticator for Android 6.2606.4246 or later to managed devices now; it is the fix.
2. Because the advisory is silent on token revocation, treat any device that ran a vulnerable build as potentially having leaked a token: revoke refresh tokens / re-require sign-in for affected work accounts via Entra ID.
3. On managed fleets, review sideloading and unknown-sources policy — the attack needs a hostile app on the device, not root.
4. Hunt Graph sign-in logs for token use from unexpected client apps on Android handsets.

Context

This is the broker-impersonation class again: a trusted on-device component that authenticates callers by what they claim rather than what they are. The safe default is to bind the decision to the verified calling package, not to a self-reported name — the same mistake that has surfaced in Android account-manager and SSO brokers before.