Microsoft Authenticator for Android let any app pose as Teams and get work tokens

Microsoft Authenticator for Android let any app pose as Teams and get work tokens

23 October 2026: Microsoft Authenticator for Android had a flaw that let any installed app, with no permissions at all, obtain access tokens for the work account signed in on the phone. Microsoft fixed it in Authenticator 6.2606.4246 as part of its September updates and tracks it as CVE-2026-80097, an elevation of privilege rated important, CVSS 3.1 8.6. The researchers who found it, at Enclave, published the details on 23 October, and the story drew wider attention this week.

Not yet independently verified. Microsoft and the researchers disagree on user interaction: Microsoft's record says the user must complete an authentication flow, while Enclave says nothing beyond a signed-in work account was needed. Microsoft's record gives no release date for this CVE beyond its September update, and says it was not exploited when we read it. We will update this when it can be confirmed, and remove this note.

How it worked

On Android, Authenticator acts as the sign-in broker for Microsoft work accounts: other Microsoft apps ask it for tokens instead of asking the user to sign in again. Enclave's researcher Ofek Levin found that one of the broker's activities was exported to all apps and checked only that it had been started by another activity. The caller supplied its own description of who it was, including the app name, package name, client ID, redirect URI and scopes. The broker checked that the redirect URI matched the package the caller claimed to be, but it did not check that the caller really was that package. Any app could therefore claim to be Microsoft Teams and receive Teams' tokens.

Enclave says that in its tests the tokens gave full delegated access to mail, files and calendar, and that nothing more than a signed-in work account on the device was needed. Heise adds that the tokens came back in plain text, and that the broker could have read the real caller's identity but did not use it.

Where Microsoft differs

Microsoft's record describes the attack differently. It says an attacker must install and run a malicious app on the device and convince the user to complete an authentication flow in Authenticator, and that success lets the attacker "obtain authentication tokens and access resources as the affected user". It marks the flaw as not publicly disclosed and not exploited, with exploitation less likely, and says customer action is required. Both accounts agree on the fix version and on what an attacker gets.

What IT teams should do

Devices that carry work accounts should run Authenticator 6.2606.4246 or later. Organisations using Intune app protection policies or managed Google Play can set a minimum app version so that older builds lose access; that is our suggestion, not Microsoft's guidance. Because a stolen token works until it expires, security teams that find an outdated Authenticator alongside an unknown sideloaded app should treat the account's sessions as exposed and revoke them. The case is also a reminder that phone-based brokers hold the keys to every Microsoft app on the device, so mobile app inventories belong in identity reviews.

Related on TrustList:

• Canada warns of help-desk phone scams that relay MFA to break into Microsoft 365
• Google opens Registered App Stores for Android on 1 December
• Korea fines Google and Apple 63.7 billion won over app payment rules

Sources

• Microsoft Security Response Center: CVRF 2026-Sep, CVE-2026-80097 Microsoft Authenticator Elevation of Privilege Vulnerability, 28 October 2026
• Enclave: AuthMask, we made Microsoft Authenticator hand over tokens to an app with zero permissions (Ofek Levin, 23 October 2026), 23 October 2026
• heise online: Microsoft Authenticator flaw let malicious apps steal access tokens, 28 October 2026