Microsoft has patched a high-severity flaw in Authenticator for Android that let a malicious app with no declared permissions steal work account access tokens, according to research disclosed on 26 October 2026. The flaw, tracked as CVE-2026-80097 and scored 8.6 out of 10, affects Authenticator versions earlier than 6.2606.4246. Microsoft classified it as a local elevation-of-privilege vulnerability.

How the impersonation worked

Security researchers at Enclave found the problem in an exported Android activity called AccountChooserActivity, which other apps on the device could launch. The vulnerable workflow trusted identity details supplied by the requesting app, including the claimed package name, client ID, redirect URI and scopes, instead of confirming that the real calling application matched that package. An attacker could therefore masquerade as an installed Microsoft application, such as Microsoft Teams, construct the expected redirect URI from the legitimate app's installed signature, and pass validation.

What an attacker could obtain

Once the request was accepted, Authenticator would return token data to the requesting app, which could contain access tokens, refresh tokens, ID tokens and client information. In testing, impersonating Microsoft Teams for Microsoft Graph access yielded delegated permissions covering mailbox, calendar, files, SharePoint and chat. The request needed no user approval, account credentials or Android permissions beyond being installed on the device, but it did require a signed-in work account on the device.

What to do now

Update Microsoft Authenticator for Android past version 6.2606.4246, and treat any device that carried the vulnerable version with a signed-in work account as potentially exposed until tokens have been revoked or refreshed. The flaw is local, not remote: it needs a malicious app already installed on the device. That matters for managed devices: Authenticator brokers sign-ins across Microsoft apps, so a wrongly issued token can reach beyond a single mailbox.