Microsoft Authenticator Android Flaw Allowed Unauthorized Token Theft by Malicious Apps

Vulnerability Details

Microsoft addressed a security flaw, tracked as CVE-2026-80097, in its Authenticator app for Android. This vulnerability allowed a malicious application, even without specific permissions, to pose as a trusted Microsoft application like Teams. By doing so, it could collect sign-in tokens for a victim's work account.

The flaw was rated 8.6 on the CVSS scale by Microsoft, categorizing it as "Important." Successful exploitation could lead to full access to an account's email, files, and calendar, according to researchers. Microsoft stated that exploitation also required the victim to complete a sign-in step within Authenticator and confirmed no active attacks have utilized this flaw.

Technical Mechanism of the Flaw

The Authenticator app on Android functions as a broker for other Microsoft applications, providing sign-in tokens. The vulnerability stemmed from the app's AccountChooserActivity component, which any app on the device could initiate. When a malicious app started this activity, Authenticator constructed its token request using values supplied by the attacker's app, including the claimed identity of the app.

A signature check intended to prevent impersonation failed because it only verified if the signature matched that of the genuinely installed, impersonated app (e.g., Teams). The Authenticator app did not use information about the actual requesting app to deny the token, allowing the malicious app to receive tokens for the work account signed into Authenticator on that device.

Resolution and Impact

Microsoft released a fix for this vulnerability in Authenticator for Android version 6.2606.4246. Users are advised to update their app to this version or newer to mitigate the risk. The research detailing this flaw was conducted by Ofek Levin through a fellowship program at Enclave, which published technical specifics on October 23, 2026.