Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Overview
Microsoft has addressed a significant vulnerability in its Authenticator app for Android, identified as CVE-2026-80097. This flaw allowed malicious apps to impersonate trusted Microsoft applications, like Teams, and steal sign-in tokens from users' work accounts without requiring any permissions. The issue was particularly concerning because it could have impacted users who rely on these apps for secure access to their corporate environments. Microsoft has released a fix in version 6.2606.4246 of the Authenticator app, urging users to update their applications to protect their accounts. This incident serves as a reminder of the importance of keeping software up to date to mitigate potential security risks.
Key Takeaways
- Affected Systems: Microsoft Authenticator app for Android, affected version prior to 6.2606.4246
- Action Required: Users should update to Microsoft Authenticator for Android version 6.
- Timeline: Newly disclosed
Original Article Summary
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,
Impact
Microsoft Authenticator app for Android, affected version prior to 6.2606.4246
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Newly disclosed
Remediation
Users should update to Microsoft Authenticator for Android version 6.2606.4246 to mitigate the vulnerability.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Android, CVE, Microsoft, and 3 more.