Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has patched a vulnerability in Microsoft Authenticator for Android that allowed an app with zero declared permissions to impersonate a trusted Microsoft app like Teams and extract sign-in tokens for a victim's work account. The issue, tracked as CVE-2026-80097 and rated 8.6 on CVSS, stems from an exposed component called AccountChooserActivity, which any installed app could invoke and trick into believing it was Teams, since Authenticator's signature check only verified that the real Teams app existed on the device rather than confirming who actually made the request. Researcher Ofek Levin, via a fellowship at security firm Enclave, showed that stolen tokens could grant read/write access to the victim's mail, files, and calendar; Enclave says no user interaction beyond having a signed-in account was needed, while Microsoft maintains the attack also requires the victim to complete an authentication step in Authenticator. Microsoft fixed the flaw in Authenticator version 6.2606.4246 as part of its September 2026 Patch Tuesday, states it has not been exploited in the wild or disclosed publicly before the patch, and it is not currently listed in CISA's Known Exploited Vulnerabilities catalog; users and organizations managing Android devices should update immediately.