Microsoft Authenticator Flaw CVE-2026-80097 Could Expose Account Tokens on Android

Microsoft has patched a high-severity security vulnerability in Microsoft Authenticator for Android that could allow a malicious application to obtain authentication tokens without requesting Android permissions or user approval, according to the supplied report.

Tracked as CVE-2026-80097, the vulnerability carries a reported CVSS score of 8.6. It was classified as a local elevation-of-privilege issue involving improper authentication in Authenticator’s broker component.

The flaw highlights the importance of securing mobile authentication systems, particularly on devices used to access corporate email, cloud storage, and Microsoft 365 services.

How the Microsoft Authenticator Vulnerability Worked

According to security researchers at Enclave, the vulnerability affected Android devices with Microsoft Authenticator installed and a work account signed in.

The issue involved an exported Android activity named com.microsoft.identity.client.AccountChooserActivity. Other applications on the same device could launch this activity and submit authentication requests.

The vulnerable component relied on identity information supplied in the request, including the claimed application package name, client ID, redirect URI, requested scopes, and caller UID. The researchers reported that the application could manipulate these values to impersonate a trusted Microsoft application.

This meant the broker could trust a claimed application identity without adequately verifying the actual application making the request.

How Attackers Could Obtain Microsoft Account Tokens

Enclave demonstrated that a malicious application could impersonate a legitimate Microsoft client, such as Microsoft Teams, to request delegated authentication tokens.

The researchers found that redirect URI validation relied on the claimed application identity. By claiming to be a legitimate installed application, the malicious app could potentially pass the vulnerable validation process.

Successful requests could return authentication information through the activity result bundle, including access tokens, refresh tokens, ID tokens, and client information.

Depending on the permissions associated with the impersonated client, exposed tokens could potentially provide access to Microsoft Graph resources, including mailboxes, calendars, OneDrive files, SharePoint content, and Teams-related services.

The actual impact depends on the token’s permissions and the resources it can access. The findings do not mean every affected device automatically exposes all Microsoft 365 data.

Microsoft Authenticator Fix and Affected Devices

Microsoft addressed the vulnerability in Microsoft Authenticator for Android version 6.2606.4246, which the supplied report identifies as released in July 2026.

The affected scenario involved Android devices running Authenticator with a signed-in work account. Users and organisations should check the current app version and consult Microsoft’s official security advisory for the applicable remediation instructions.

The issue also illustrates a broader mobile security principle: authentication brokers must validate the real calling application’s identity rather than trusting values supplied by the requesting application.

Security Recommendations for Organisations

Organisations using Microsoft Authenticator should take the following steps:

• Update Authenticator: Ensure Android devices use a version containing Microsoft’s security fix.

• Enforce mobile application management: Use mobile device management (MDM) or enterprise mobility management (EMM) to monitor app versions and distribute updates.

• Restrict sideloading: Where appropriate, limit the installation of applications from untrusted sources.

• Monitor account activity: Investigate unusual Microsoft Graph access, unfamiliar devices, and suspicious authentication patterns.

• Review access controls: Apply least privilege and require appropriate multifactor authentication and conditional access policies.

• Investigate suspected compromise: Follow the organisation’s incident response procedures if unauthorised token access is suspected.

These measures can reduce exposure and help organisations identify suspicious activity. Updating the vulnerable application remains a key remediation step.

Conclusion

CVE-2026-80097 demonstrates how weaknesses in mobile authentication brokers can undermine application identity checks and potentially expose account tokens. Organisations should verify that Microsoft Authenticator is updated, strengthen mobile application controls, and monitor for unusual account activity.