Microsoft has fixed a flaw in its Authenticator app for Android that could have let a malicious app with no permissions pose as a trusted Microsoft app and collect sign-in tokens for a victim's work account, researchers disclosed on 27 October 2026.

How the flaw worked

Tracked as CVE-2026-80097 and rated 8.6, the flaw lay in Authenticator's role as a sign-in broker on Android: when an app such as Teams or Outlook needs to sign a user in, Authenticator hands it a token proving the user is already verified. A component called AccountChooserActivity could be started by any app, and it built its token request from values supplied by the calling app, including the name of the app it claimed to be. In the researchers' tests, an app claiming to be Teams received tokens giving full access to the account's email, files and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.

What users should do

The flaw is fixed in Authenticator for Android version 6.2606.4246, so anyone using the app should update to that version or later. The research comes from Ofek Levin, working through a fellowship programme at security firm Enclave, which published its technical write-up, titled AuthMask, on 23 October 2026, after the patch was available. Microsoft assigned the CVE on 8 September 2026.

Sources: The Hacker News; Enclave research via PBX Science, 27 October 2026.