Microsoft has addressed a security vulnerability in its Authenticator application for Android that could have allowed a malicious application without special permissions to impersonate a trusted Microsoft application and obtain authentication tokens for a user’s work account. The vulnerability, tracked as CVE-2026-80097, has been resolved in Microsoft Authenticator for Android version 6.2606.4246, and users are advised to update to the latest release. According to Microsoft, successful exploitation would require a victim to install a malicious application and complete a sign in process within Authenticator. The company also stated that it has found no evidence that the vulnerability has been used in real world attacks. The issue was assigned a CVSS score of 8.6, which Microsoft classifies as an Important severity vulnerability.
Technical details of the vulnerability were published on October 23, 2026, by security researcher Ofek Levin, who conducted the research through a fellowship program at security firm Enclave. Microsoft assigned the CVE on September 8, 2026, before releasing a fix as part of its September 2026 Patch Tuesday security updates. On Android devices, Microsoft Authenticator serves not only as a multi factor authentication application but also as an authentication broker for Microsoft services such as Teams and Outlook. When these applications require user authentication, Authenticator issues digital tokens that confirm the identity of the signed in user. Because these tokens provide access to corporate resources, the broker is expected to verify that only legitimate applications can request them. According to Enclave’s analysis, an exposed Android component known as AccountChooserActivity accepted requests from any installed application. A malicious application could provide values claiming to be a trusted Microsoft application, such as Teams, and Authenticator would process the request using those supplied details.
Enclave reported that Microsoft Authenticator performed a signature verification process intended to validate requesting applications, but the verification relied on the signature of the legitimate application being impersonated rather than confirming the identity of the application actually initiating the request. Since the genuine Microsoft Teams application could already be installed on the device, the expected signature was available, allowing the verification process to succeed under the demonstrated conditions. Researchers also noted that Authenticator was technically capable of identifying which application initiated the request but did not use that information when determining whether to issue an authentication token. During testing, Enclave stated that tokens requested while impersonating Microsoft Teams included Microsoft Graph permissions that enabled access to email, files, and calendar resources associated with the authenticated work account. Microsoft described the potential impact more broadly, stating that a successful attacker could authenticate as the signed in user and access that user’s available resources. The company also clarified that the vulnerability only affected the work account registered in Authenticator on the compromised device and did not extend to unrelated accounts.
Microsoft and Enclave differ on one aspect of the attack scenario. Enclave reported that its proof of concept obtained authentication tokens without requiring additional user interaction beyond the presence of a signed in account. Microsoft, however, stated that exploitation requires both installation of a malicious application and user interaction to complete an authentication flow within Authenticator, a requirement also reflected in the official CVSS assessment. Microsoft further noted that the vulnerability had not been publicly disclosed before the fix became available, has not been observed in active attacks, and is considered less likely to be exploited. As of October 26, 2026, CISA had not included CVE-2026-80097 in its Known Exploited Vulnerabilities catalog. Organizations managing Android devices are encouraged to ensure Microsoft Authenticator is updated to version 6.2606.4246 or later through enterprise device management policies where applicable. Microsoft has published the software update guidance, although the advisory does not specify whether updating invalidates authentication tokens that may have already been obtained before the patch was installed.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
