Critical Microsoft Authenticator flaw exposes Android tokens

Key Takeaways

• A critical vulnerability (CVE-2026-80097) was discovered in Microsoft Authenticator for Android.
• The flaw allowed unprivileged malicious Android applications to steal access tokens for Microsoft work accounts.
• Affected users are those with Microsoft Authenticator installed and a work account signed in on Android devices.
• Microsoft has released a patch in Authenticator for Android version 6.2606.4246.
• The vulnerability carried a high-severity CVSS score of 8.6.

Microsoft has addressed a high-severity vulnerability, tracked as CVE-2026-80097, within its Authenticator application for Android. This flaw, rated with a CVSS score of 8.6, could enable malicious applications lacking any declared permissions to illicitly acquire work account access tokens.

The core issue stemmed from improper authentication within the Authenticator’s broker component. Microsoft categorized this as a local elevation-of-privilege vulnerability, impacting Android devices where Microsoft Authenticator was installed and a work account was actively signed in.

The Authentication Bypass Mechanism

Researchers at Enclave reported that an untrusted application could effectively impersonate a legitimate Microsoft application, such as Microsoft Teams. This allowed the rogue app to request delegated tokens from the Authenticator app for the fabricated identity.

Crucially, this malicious request did not necessitate user approval, account credentials, or any specific Android permissions beyond the application simply being installed on the device. The vulnerability centered around an exported Android activity within Authenticator, specifically named com.microsoft.identity.client.AccountChooserActivity.

Exported activities are designed to be launched by other applications on the same device. In this scenario, the vulnerable activity would accept a broker request from the calling application and, after processing, return the authentication result. The fundamental flaw resided in how Authenticator validated the requesting application.

Exploiting Trust: The Impersonation Vector

The broker request included several fields that typically identify the calling app: the claimed app package name, client ID, redirect URI, requested scopes, and even a caller UID value. Enclave’s findings revealed that a malicious application could supply these fields with arbitrary values, rather than having them inherently tied to the actual app initiating the request.

While Authenticator did perform a signature-related redirect URI validation, this check was critically misdirected. It focused solely on the app identity claimed within the request. For instance, if an attacker claimed to be Microsoft Teams, the vulnerable logic would verify if the provided redirect URI matched the legitimate installed Teams package.

Since Microsoft Teams would typically be legitimately installed on the device, the attacker could construct a valid redirect URI using Teams’ public package signature, thereby successfully bypassing the validation. In essence, the Authenticator verified the apparent validity of the claimed identity but failed to confirm that the actual caller was, in fact, the application it purported to be. The research indicated that while the vulnerable activity could determine the package that launched it, this critical information was not used to establish trust.

Impact and Remediation

Successful exploitation of this flaw allowed the attacker to receive token data, including access tokens, refresh tokens, ID tokens, and client information, through the activity result bundle. Depending on the impersonated Microsoft client and the permissions requested, the ramifications could extend to sensitive Microsoft Graph resources, such as mailboxes, calendars, OneDrive files, SharePoint content, and various Teams-related services.

The researchers demonstrated the severity by impersonating multiple Microsoft applications. For example, a Teams identity requesting Microsoft Graph access could yield delegated permissions allowing the malicious app to read and write email, send messages, access files, and modify calendars. This vulnerability posed a significant risk for organizations utilizing Android devices to access Microsoft 365 workloads.

Microsoft has since patched this issue in Microsoft Authenticator for Android version 6.2606.4246, which was released in July 2026. Microsoft’s advisory describes the issue as improper authentication leading to potential privilege escalation by an unauthorized local attacker.

This incident underscores the critical necessity for mobile identity brokers to robustly validate the true calling application, including its package identity, UID, and signing certificate, rather than relying on app-controlled values embedded within an intent. It also highlights Microsoft’s ongoing efforts to secure Entra credentials on Android and iOS devices, particularly in environments where rooted or jailbroken devices could amplify enterprise identity risks.

What You Should Do

• Update Immediately: Organizations and individual users must update Microsoft Authenticator for Android to version 6.2606.4246 or newer through Google Play without delay.
• Verify Managed Devices: Administrators should ensure that all managed Android devices are running the patched version of Microsoft Authenticator via MDM or EMM platforms.
• Review Mobile Application Controls: Strengthen mobile application security policies, enforce timely app updates, and restrict the installation of sideloaded applications where feasible.
• Monitor for Anomalies: Security teams should actively monitor for unusual Microsoft Graph activity, unexpected consent requests, or token usage originating from unfamiliar Android devices.
• Consult Advisory: Refer to Microsoft’s official CVE-2026-80097 advisory for the latest remediation guidance and technical details.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.