Microsoft has fixed a flaw in its Authenticator app for Android that could have let a malicious app pose as Microsoft Teams and collect work-account sign-in tokens, according to research published by Enclave.

How the flaw worked

The flaw, tracked as CVE-2026-80097 and rated 8.6 out of 10 for severity, left an Android component called AccountChooserActivity exposed, so a permissionless malicious app could present itself as Teams during sign-in.

In researchers' tests, the tokens obtained could give access to a victim's work email, files and calendar. Microsoft said exploitation would also require the victim to complete a sign-in step, and that the flaw has not been used in attacks.

Fix available

The issue is fixed in Authenticator for Android version 6.2606.4246, and users should make sure the app is updated. Authenticator is widely used to approve sign-ins and generate codes for work and personal accounts, which is why a flaw affecting its sign-in flow drew attention. Organisations that rely on it for staff sign-ins should confirm devices are running the fixed version. The vulnerability was assigned its CVE number on 8 September, with research details published on 23 October by researcher Ofek Levin.

The case is a reminder to install app updates promptly and to check carefully which app is asking for a sign-in, even when it looks familiar.

Source: The Hacker News.