CVE-2026-80097
CVSS 8.6 HIGH: improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. Microsoft patch: Release Notes.
Vulnerabilities & Exploits · Credential Theft
Enclave researcher Ofek Levin found that a flaw in Microsoft Authenticator for Android let any installed app obtain work-account tokens; Microsoft patched it on September 8, 2026. The flaw, CVE-2026-80097, affected versions before 6.2606.4246.
Authenticator brokers sign-ins for Microsoft apps such as Teams and Outlook. It trusted an app’s claim that it was Teams instead of verifying which app was actually calling, allowing a malicious app to get tokens without a permission prompt or user tap. Those tokens could expose email, files and other work data; the rogue app could also add its own passkey, preserving account access after the app was removed.
For organizations using Authenticator on managed Android devices, the flaw puts the credential broker and the Microsoft account’s sign-in methods in the same trust picture: updating the app closes the flaw, but an attacker-added passkey can leave access in place.
1 source · 6h ago
CVSS 8.6 HIGH: improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. Microsoft patch: Release Notes.
Help Net Security
Microsoft Authenticator vulnerability let rogue Android apps steal work account access - Help Net Security
A Microsoft Authenticator vulnerability let any Android app steal work account tokens.
originalPart of the PlainSec briefing for 2026-10-27
Every edition of this story: Android Authenticator flaw exposed work accounts to rogue apps