Microsoft Authenticator Vulnerability CVE-2026-80097: The Android Flaw That Let Apps Pose as Teams to Get Work Tokens

Microsoft has fixed a flaw in Microsoft Authenticator for Android that could let another app on the same phone get sign-in tokens for the work account signed in to Authenticator. Those tokens can open email, files and calendars without a password or MFA prompt, so every Android phone in your business that uses Authenticator should be on version 6.2606.4246 or later.

What happened with Microsoft Authenticator on Android

On Android, Authenticator does more than show codes and approve prompts. It also acts as a sign-in broker. When Teams, Outlook or another Microsoft app needs to sign in to a work account, it asks Authenticator for a token. That token is what proves to Microsoft 365 that the request really comes from you.

Ofek Levin, a researcher at the security firm Enclave, found that Authenticator did not properly check who was asking. In a report published on Friday, October 23, 2026, which Enclave calls AuthMask, the researchers say one part of the app, AccountChooserActivity, could be opened by any app on the device. The requesting app described itself, including which Microsoft app it claimed to be. The check meant to catch impostors compared that claim against the signature of the real app installed on the phone. If the genuine Teams app was installed, the check passed. Enclave says Authenticator could see which app was really calling but did not use that when deciding whether to hand over a token.

Microsoft tracks the bug as CVE-2026-80097 and released the fix on Tuesday, September 8, 2026, in its September Patch Tuesday release. Enclave published its technical write-up about six weeks later.

What is confirmed and what is only claimed

Confirmed by Microsoft

• Name and rating: Microsoft Authenticator Elevation of Privilege Vulnerability, CVSS 3.1 score 8.6, Microsoft severity Important.
• Affected app: Microsoft Authenticator for Android. The CVE record lists versions 6.0.0 up to, but not including, 6.2606.4246.
• Fix: version 6.2606.4246, released September 8, 2026. On September 15, 2026, Microsoft revised the advisory to correct the fix build number. Check for that exact number. Don't assume that any September update is enough.
• Exploitation: Microsoft lists the flaw as not exploited, not publicly disclosed before the fix, and "Exploitation Less Likely."
• How it works: Microsoft says an attacker would need to install and run a malicious app on the device and get the user to complete an authentication flow in Authenticator. If that worked, the attacker could get tokens and access resources as that user.

Claimed by the researchers

• The malicious app needed no special permissions.
• Their proof of concept got tokens with no user interaction beyond having a work account signed in. Microsoft says the user has to complete a sign-in step. We cannot settle that difference, so plan as if the researchers are right.
• Posing as Teams, they got Microsoft Graph tokens with permissions including Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite and Sites.ReadWrite.All. Posing as Authenticator itself, they got tokens that could manage sign-in methods and create or delete passkeys.
• The tokens returned included refresh tokens, handed over in plain text.

Not known

• Whether updating the app cancels tokens a malicious app may already hold. Neither Microsoft nor Enclave says.
• When Enclave reported the flaw to Microsoft. Its timeline gives no report date.
• Whether any real app abused the flaw. Microsoft says it has seen no exploitation, and we found no public report of attacks.

Why this matters for a company network

Passwords and MFA protect the moment of sign-in. A token is what an app receives after that moment, and it is what attackers want. With a token that includes Mail.Send, someone can send email as your owner or controller, which is how invoice and payment fraud often starts. Files.ReadWrite.All and Sites.ReadWrite.All reach OneDrive and SharePoint, where contracts, client records and HR files are stored.

The risk is highest on phones the business does not manage. Staff install games, coupon apps and apps from outside Google Play on personal phones that also hold a work account. Phones are part of your network now, and they need patching just like servers and laptops.

How to check and fix it this week

Steps 3, 4, 5 and 7 are our practical advice, not instructions from Microsoft's advisory.

Is MFA still worth it?

Yes. MFA did not fail here. The problem was that a sign-in app trusted the wrong caller after sign-in. Hardware security keys are still a strong choice for admin and finance accounts because they resist phishing. But a key would not necessarily have stopped this bug, because the tokens were handed out after the user had already signed in. Several layers matter more than any single factor: managed devices, Conditional Access that requires a compliant device, sensible session lengths, and alerts for unusual sign-ins or mailbox rules.

Microsoft Authenticator vulnerability questions people are asking

Is Microsoft Authenticator safe to use now?

Yes, once it is on version 6.2606.4246 or later. Microsoft has fixed the flaw and says it has not seen it used in attacks.

Does the Authenticator flaw affect iPhone?

Microsoft's advisory lists only Microsoft Authenticator for Android, and Enclave's research covers Android only.

Can someone steal my Teams or Outlook sign-in this way?

On older builds, the researchers say a rogue app could pose as Teams and get tokens for mail, files and calendars for the work account on that phone. The update closes that gap.

Was anyone hacked through this?

Microsoft says the flaw was not exploited.

Does updating remove tokens that were already stolen?

That is not known. If you suspect a problem, revoke the user's sessions.

The bigger lesson

A strong login does not help if the app that hands out tokens trusts whoever asks. Security fixes ship in phone apps too, and someone has to confirm that every device actually got them.

Want a second set of eyes on your Microsoft 365 devices and sign-ins? See our security hardening services or request a tech quote.

Get security alerts like this by email, along with our free checklist, at our security alerts page.

Sources: Microsoft Security Update Guide, CVE-2026-80097; Enclave, AuthMask research; CVE record, CVE-2026-80097; Microsoft Learn, Revoke user access in an emergency.