Microsoft Authenticator vulnerability let rogue Android apps steal work account access

Security researchers at Enclave uncovered a serious flaw in Microsoft Authenticator for Android that allowed any installed application to silently hijack access to a victim's work account. Authenticator acts as a broker that issues sign-in tokens to apps like Teams and Outlook, but it failed to properly verify which app was actually requesting a token, instead trusting self-reported identity claims that any app could forge. Ofek Levin, a fellow at Enclave, demonstrated that a malicious app could impersonate Teams, grab email, files, calendar and SharePoint access, send messages on the victim's behalf, and even manipulate sign-in methods by posing as Authenticator itself — including adding rogue passkeys that would survive removal of the attacking app. No user interaction or special permissions were required, making the theft invisible to the victim, though a malicious app still had to be installed on the device first. Microsoft confirmed the issue, assigned it CVE-2026-80097 with a CVSS score of 8.6, and shipped a fix on September 8, 2026; all versions of Microsoft Authenticator for Android prior to 6.2606.4246 are affected, so users and administrators should update immediately and enforce the minimum version through MDM where applicable.