Microsoft fixes Android Authenticator work-token impersonation flaw
Microsoft has fixed CVE-2026-80097, a vulnerability in Microsoft Authenticator for Android that could allow a malicious app with no permissions to impersonate a trusted Microsoft application and obtain tokens for a signed-in work account. The company fixed the issue in version 6.2606.4246 and assigned it a CVSS score of 8.6, rated Important.
Security researcher Ofek Levin identified the issue through a fellowship programme at Enclave. Enclave published technical details on October 23, while Microsoft assigned the CVE on September 8 as part of its September 2026 Patch Tuesday release.
How the token broker could trust the wrong app
Authenticator on Android is not limited to generating one-time codes. It can act as a broker when Microsoft applications such as Teams or Outlook need to sign in: the application asks Authenticator for a token, and Authenticator returns a credential representing the user’s authenticated session.
The affected application exposed an activity called AccountChooserActivity that any local app could start. Enclave found that an attacker could supply values used to build the token request, including the identity of the application it claimed to be. A malicious app could therefore identify itself as Teams.
A signature validation was intended to prevent impersonation. However, the check retrieved the real signature of the app being impersonated and confirmed that the request matched it. If Teams was genuinely installed, its signature was available and the validation passed. Enclave said Authenticator could identify the actual calling app, but did not use that information to decide whether the token should be issued.
Scope, user interaction and remediation
In Enclave’s testing, an app posing as Teams could request Microsoft Graph tokens with permissions to read and send email, read and write files, and read and write calendar data. Microsoft describes the outcome more broadly: a successful attacker could authenticate as the signed-in user and access that user’s resources. The exposure applies to the work account signed into Authenticator on the affected device, rather than other accounts.
Microsoft and Enclave differ on the interaction required for exploitation. Enclave said its proof of concept returned tokens without user action beyond a signed-in account. Microsoft’s advisory says an attacker must install a malicious app and persuade the victim to complete an authentication flow in Authenticator; its CVSS assessment likewise includes user interaction.
Microsoft says the flaw has not been exploited in attacks, was not publicly disclosed before the fix, and is considered less likely to be exploited. It was not among the two Windows vulnerabilities already under attack in September, a distinction that complements Microsoft MDASH findings on Windows vulnerabilities on the Windows issues identified by Microsoft MDASH.
Actions for Android device managers
Organizations should require Microsoft Authenticator for Android version 6.2606.4246 or later through their mobile device management controls. Microsoft’s advisory does not state whether an update invalidates tokens already obtained by a malicious application, so the available information does not resolve that question. The immediate business implication is to verify deployed Authenticator versions and enforce the minimum patched release on devices carrying work accounts.