started · updated
Microsoft Authenticator Android flaw patched to prevent token theft
Microsoft has released a security update to address a critical vulnerability in its Authenticator app for Android, identified as CVE-2026-80097. The flaw, which received a CVSS severity score of 8.6, allowed malicious applications with zero system permissions to impersonate trusted Microsoft services, such as Microsoft Teams, to steal authentication tokens.
Security researchers from Enclave, including Ofek Levin, discovered the issue. The vulnerability resided in the ‘AccountChooserActivity’ component. While the Authenticator app verified that the claimed application was installed on the device, it failed to verify which application was actually making the request. This allowed an attacker to intercept access and refresh tokens, granting unauthorized access to a user’s work email, files, calendar, and SharePoint sites.
Microsoft addressed the flaw in version 6.2606.4246 of the Android app. While researchers noted the attack could potentially occur without further user interaction once a malicious app is installed, Microsoft’s advisory suggests exploitation may involve a user completing an authentication flow. There have been no reports of this vulnerability being exploited in the wild prior to the patch.
Entities
Android · Enclave · Microsoft · Microsoft Teams · Ofek Levin
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] The vulnerability was not exploited in the wild before the patch. totalsecurity.com.br · expertinsights.com
- [● 5 SOURCES] Ofek Levin discovered the vulnerability through an Enclave fellowship. www.jbklutse.com · totalsecurity.com.br · jornal24horas.com.br · expertinsights.com · stadt-bremerhaven.de
- [● 8 SOURCES] Microsoft Authenticator for Android had a security flaw identified as CVE-2026-80097. www.jbklutse.com · totalsecurity.com.br · jornal24horas.com.br · expertinsights.com · sempreupdate.com.br · +3 more
- [● 6 SOURCES] Microsoft released a fix in version 6.2606.4246. www.jbklutse.com · totalsecurity.com.br · jornal24horas.com.br · sempreupdate.com.br · pc.watch.impress.co.jp · +1 more
- [● 6 SOURCES] Stolen tokens could provide access to email, files, and calendars. www.jbklutse.com · totalsecurity.com.br · expertinsights.com · pc.watch.impress.co.jp · stadt-bremerhaven.de · +1 more
- [● 5 SOURCES] The flaw involved the AccountChooserActivity component. totalsecurity.com.br · jornal24horas.com.br · expertinsights.com · sempreupdate.com.br · stadt-bremerhaven.de
- [● 5 SOURCES] The vulnerability was assigned a CVSS score of 8.6. totalsecurity.com.br · jornal24horas.com.br · expertinsights.com · pc.watch.impress.co.jp · stadt-bremerhaven.de
- [● 7 SOURCES] Malicious apps without permissions could impersonate Microsoft apps to steal tokens. www.jbklutse.com · totalsecurity.com.br · jornal24horas.com.br · expertinsights.com · pc.watch.impress.co.jp · +2 more