Vulnerabilities · Identity
Microsoft Authenticator flaw let Android apps steal work account access
A vulnerability in Microsoft Authenticator for Android let rogue apps steal tokens for work accounts. The flaw is fixed, but users must update to stay safe.
Ross Grant2 min read
The short version
Researchers found a flaw in Microsoft Authenticator for Android that let any app on your phone steal access to your work account, even if you didn't give it special permissions. The flaw is now fixed, but you need to update the app to stay safe. If you use Authenticator for work, check you're on the latest version. This shows how important it is to keep security apps up to date.
What happened?
A vulnerability in Microsoft Authenticator for Android let any app on the device steal access tokens for a user's work account by pretending to be a trusted Microsoft app. The flaw, tracked as CVE-2026-80097, was discovered by researchers at Enclave and has now been fixed by Microsoft. Users must update to version 6.2606.4246 or later to be protected.
How the flaw works
A flaw in Microsoft Authenticator for Android let any app on the device steal access tokens for a user's work account, according to researchers at Enclave and reports from Help Net Security (opens in a new tab) and The Hacker News (opens in a new tab). The vulnerability, tracked as CVE-2026-80097, affected all versions before 6.2606.4246.
Authenticator is not just a code generator. On Android, it also acts as a broker: when Microsoft apps like Teams or Outlook need to sign you in, they ask Authenticator for a token, a digital pass that proves you are logged in. The flaw let any app, even without special permissions, ask Authenticator for these tokens by pretending to be a trusted Microsoft app. The check that was supposed to verify the app's identity could be bypassed if the real app (like Teams) was installed, because its signature was readable by any app.
What was taken
In tests by Enclave, a malicious app could get tokens that allowed it to read and send email, access files, view and edit calendars, and even change sign-in methods for the account. This included the ability to create or delete passkeys, which could let an attacker keep access even after the malicious app was removed. The attack required the victim to have a work account signed into Authenticator and to install a rogue app, but no further user action was needed in Enclave's tests. Microsoft, however, says the user would need to complete a sign-in step in Authenticator for the attack to work.
The response
Enclave reported the flaw to Microsoft, which confirmed the issue and released a fix on 8 September 2026. The vulnerability was rated 8.6 ("Important") on the CVSS scale. Microsoft says there is no evidence the flaw was exploited in the wild and that exploitation is "less likely." The fix is included in Authenticator for Android version 6.2606.4246 and later. Users should update via the Google Play Store. Organisations managing devices should enforce this minimum version through their device management tools.
Is there a fix?
Yes. Updating Microsoft Authenticator for Android to version 6.2606.4246 or later protects against this vulnerability. Users and administrators should check their devices and update immediately. Microsoft has not said whether updating will revoke any tokens that may have already been stolen, so further steps may be needed if compromise is suspected.
Claimed vs confirmed
- Unconfirmed
The attack required no user interaction beyond having a signed-in account.
Enclave researchers say their test app could steal tokens without user action, but Microsoft says the user must complete a sign-in step.
- Confirmed
No evidence of exploitation in the wild.
Microsoft says there is no sign the flaw was used in real attacks before the fix.
Why it matters
Authenticator apps are meant to protect your accounts, not expose them. This flaw could have let attackers quietly take over work accounts on any affected Android device. It highlights the risks of mobile app permissions and the need to keep security software updated.
Key points
- A flaw in Microsoft Authenticator for Android let rogue apps steal work account tokens.
- The attack did not require special app permissions or user interaction, according to researchers.
- Microsoft fixed the flaw in version 6.2606.4246; users must update to be safe.
- Tokens could allow attackers to access email, files, and even change sign-in methods.
- No evidence of exploitation in the wild, but organisations should check device compliance.
Sources
Help Net Security
Reference
The Hacker News
Reference
