Microsoft recently patched a serious flaw in its Authenticator app for Android that could let a malicious app steal work account tokens without needing any Android permissions. The vulnerability, logged as CVE-2026-80097, was given a high severity rating (CVSS 8.6) and allows an untrusted app to impersonate trusted Microsoft apps, request tokens, and retrieve sensitive credentials if the user is signed in with a corporate account. This impacts any device with Microsoft Authenticator and a work account active.
How the Token Theft Happened
Security researchers from Enclave uncovered this issue. The core problem lies in the broker component of Microsoft Authenticator, specifically with an exported activity called com.microsoft.identity.client.AccountChooserActivity. Any app installed on the device—even one with zero permissions—could invoke this activity and pose as a trusted Microsoft client like Teams.
The exploited activity takes in values like the package name, redirect URI, client ID, and caller UID via intent. Authenticator validated the package name against the redirect URI signature—if both appeared legitimate, such as matching the signature of the installed Teams app, the check passed. However, Authenticator did not verify whether the calling app was truly the one it claimed to be. That allowed attackers to send fabricated details and receive tokens meant for corporate apps without user verification.
Scope and Impact
Successful exploitation could yield access tokens, refresh tokens, ID tokens, and client metadata. That level of access could allow attackers to read and send emails, manipulate calendars, access OneDrive files, get into SharePoint content, or use Teams functions. Items tied to Microsoft Graph are especially vulnerable. Organizations using Android devices to connect to Microsoft 365 workloads are particularly at risk.
The issue was fixed in version 6.2606.4246 of Authenticator for Android, released in July 2026. Users and IT administrators are urged to update to that version via Google Play immediately. For enterprise-managed devices, admins should ensure all units are on versions that include the patch.
Mitigations & Best Practices
Besides updating the app, organizations should tighten mobile application controls. That means enforcing app updates through mobile device management (MDM) or enterprise mobility management (EMM), and avoiding sideloaded apps whenever possible. Monitoring for any strange token activity—unexpected permissions or operations in Microsoft Graph—or activity from unfamiliar Android devices is also advised.
This flaw highlights how vital it is for identity brokers—those components that manage authentication across apps—to verify the actual calling application: its UID, signing certificate, package identity—not just values provided by the app itself. Relying on claims inside a request can lead to serious elevation-of-privilege openings.
While Microsoft has been working to secure enterprise identity schemes—especially for Android devices and also on iOS environments with elevated risk from rooting or jailbreaking—this incident underlines how attackers can abuse weaknesses in cross-app authentication logic.
Why this matters: Tokens carry powerful access. If corporate credentials are exposed, attackers may breach email, documents, or collaborate tools—leading to data loss, compliance violations, or financial exposure. In high-risk environments, this leak could even aid later steps of a broader attack chain.
What to watch: Keep an eye on enterprise telemetry for token abuse, ensure policy covers all mobile endpoints, and demand that identity brokers treat any supplied identity claims as untrusted unless verified via cryptographic or system-level checks. This incident should prompt a review of authentication architecture wherever trust boundaries are crossed on mobile systems.
