Microsoft has released a crucial security update for its widely used Authenticator app on Android to address a high-severity vulnerability that could have allowed malicious, permissionless applications to pose as trusted corporate utilities like Microsoft Teams and harvest sensitive authentication tokens.
Tracked officially by Microsoft as CVE-2026-80097, the security flaw carries a Common Vulnerability Scoring System (CVSS) rating of 8.6, placing it squarely in the "Important" severity bracket. The vulnerability was successfully resolved and patched in Microsoft Authenticator for Android version 6.2606.4246. Security researchers and IT administrators are strongly urging all users and organizations utilizing the app on Android devices to apply the update immediately.
The discovery of the vulnerability stems from security research conducted by Ofek Levin through a specialized fellowship program at Enclave, a prominent security firm. Enclave publicly released comprehensive technical details regarding the flaw on October 23, 2026, shedding light on a sophisticated mechanism where authentication brokers can be manipulated into issuing digital passes to unauthorized applications. Microsoft had assigned the CVE identifier to the vulnerability earlier, on September 8, following responsible disclosure.
To understand the severity of the flaw, it is necessary to examine the expanded role of the Microsoft Authenticator app within the modern Android ecosystem. On mobile devices, Authenticator functions as much more than a simple generator of time-based, six-digit multi-factor authentication codes. It routinely operates as an identity broker. When enterprise applications such as Microsoft Teams, Outlook, or other integrated services require a user to sign in or maintain a session, they do not handle the credential exchange directly. Instead, they submit a request to the Authenticator broker. In response, Authenticator evaluates the request and hands back a secure token—essentially a digital pass that confirms the user’s authenticated status. Because this broker holds ultimate control over access to the entire corporate account, it relies on stringent trust validations to ensure that tokens are only handed over to legitimate applications.
The vulnerability identified in CVE-2026-80097 bypassed these crucial trust checks by exploiting how Authenticator exposed a specific component on the Android operating system. Specifically, the application utilized an Android activity named AccountChooserActivity, which was improperly configured to allow any application installed on the device to initiate it. When a malicious app launched this activity, Authenticator would build its token request using the parameters and values supplied entirely by the calling application. Crucially, this included the identity claim of the app itself. By crafting the request to state that it was the legitimate Microsoft Teams application, the attacker’s app successfully deceived the broker into believing the identity claim.
An intricate signature-checking mechanism was originally designed to prevent this exact type of impersonation, but a flaw in its execution rendered it ineffective. The validation check was programmed to look up the cryptographic signature of the application being impersonated to confirm that the request matched official records. Because Microsoft Teams was genuinely installed on the targeted device alongside the malicious software, its authentic signature was readily available on the system to be read. As a result, the signature verification routine saw a valid signature on the device, confirmed a match, and allowed the check to pass without recognizing that the request originated from an entirely different, unauthorized application.
Furthermore, Enclave’s security analysis revealed that while Authenticator possessed the technical capability to inspect which application had actually initiated the request, it failed to utilize that data effectively when deciding whether to grant or deny the issuance of a token. In practical tests conducted by the researchers, a malicious proof-of-concept app that falsely identified itself as Teams and requested tokens through the Microsoft Graph API successfully received sweeping permissions. These permissions included the ability to read and send email, access, read, and write files, and manage calendar entries, effectively granting full visibility and control over the victim’s digital workspace.
Microsoft’s formal security advisory describes the broader implications of a successful exploit, noting that an attacker who successfully leveraged the flaw could authenticate as the signed-in user and gain unauthorized access to that user’s resources and cloud data. However, the scope of exposure is limited to the specific work account signed into the Authenticator application on that particular device, rather than extending across entirely separate accounts or independent cloud tenants.
A notable discrepancy exists between the findings published by Enclave and the official advisory details provided by Microsoft regarding the operational requirements of an attack. Enclave reported during its testing phase that its proof-of-concept mechanism was capable of retrieving authentication tokens without requiring direct user interaction, relying solely on the presence of an active, signed-in account within the mobile app. Conversely, Microsoft’s official advisory states that successful exploitation requires an attacker to first install a malicious application on the target device and subsequently convince the user to complete an authentication or confirmation flow within the Authenticator app itself. The official CVSS metrics assigned by Microsoft similarly reflect an assumption that user interaction forms part of the attack chain.
Despite the high CVSS score, Microsoft has confirmed that the vulnerability has not been actively exploited in the wild, nor was it publicly disclosed prior to the release of the official patch. The company categorized the risk of active exploitation as "less likely" at the time of disclosure. The patch was quietly incorporated into Microsoft’s broader security updates, though it was distinct from the major Windows vulnerabilities flagged during the same patch cycle as actively under attack. Furthermore, the flaw has not been listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.
Mitigating the risk entirely requires updating the Microsoft Authenticator application for Android to version 6.2606.4246 or any subsequent release. Enterprise organizations and IT administrators managing corporate mobile device fleets can enforce this security baseline by utilizing mobile device management solutions to mandate the minimum required application version across all company-managed handsets and tablets. While the update successfully closes the security gap, Microsoft’s advisory documentation leaves open the question of whether applying the patch automatically invalidates or revokes any session tokens that a malicious application might have illicitly acquired prior to the update being installed.
