Android users who sign in to a work or school account through Microsoft Authenticator should check they are running version 6.2606.4246 or later, after researchers showed an app with no special permissions could trick the app into handing over sign-in tokens for that account.

How the broker check went wrong

On Android, Authenticator does more than display codes. It also acts as a broker, passing sign-in tokens to other Microsoft apps such as Teams and Outlook so users do not have to sign in repeatedly. Researchers at Enclave found that a component used to choose an account could be started by any app on the phone. The researchers said the broker then built its request from details supplied by the calling app, including the app it claimed to be, and checked the signature of the app being impersonated rather than the app actually making the request. Because Teams was already installed with a genuine signature, that check passed. In laboratory tests, the tokens obtained gave access to mailbox, files, calendar and Teams content, and impersonating Authenticator itself could even affect sign-in methods, including passkeys.

What to check on your phone

Microsoft tracks the issue as CVE-2026-80097, rates it 8.6 and Important, and fixed it in version 6.2606.4246, published on 8 September 2026. Microsoft says exploitation also needs the user to complete a sign-in step in Authenticator and that the flaw has not been seen used in real attacks, while Enclave's test did not need that interaction, a difference users should not rely on for protection. Update from the Play Store, confirm the version, and let device managers enforce the minimum version on company phones. Avoid sideloading unfamiliar apps, and review recent sign-ins if an old version was in use alongside an unknown app.

Sources: The Hacker News and Help Net Security.