Microsoft fixed CVE-2026-80097 (CVSS 8.6) in Authenticator for Android. A malicious app with zero permissions could pose as a trusted Microsoft app like Teams and get Authenticator to hand it sign-in tokens for your work account. The fix is in version 6.2606.4246.
What went wrong
On Android, Authenticator acts as a broker that hands tokens to Microsoft apps. Researcher Ofek Levin (Enclave) found an exported activity, AccountChooserActivity, that any app could start. The attacker’s app claimed to be Teams, and the signature check passed because the real Teams was installed. Authenticator could see who actually asked, but didn’t use that. In tests, the tokens could read and send mail and read and write files and calendars.
Microsoft says exploitation needs the victim to finish a sign-in step and that it hasn’t been used in attacks. Enclave says its proof of concept needed no interaction beyond a signed-in account. Weigh that gap yourself.
What to do
- Update Authenticator from the Play Store and check you’re on 6.2606.4246 or later.
- Be picky about sideloaded or random apps on any phone that holds a work account.
God Bless, and Needs Garlic!
