588/69 Wednesday, October 28, 2026
Researchers have disclosed details of CVE-2026-80097 in Microsoft Authenticator for Android, an Improper Authentication vulnerability rated High with a CVSS v3.1 score of 8.6, while Microsoft classifies the issue as Important. The flaw could allow a malicious application installed on the device to impersonate a Microsoft application, such as Teams, and request tokens associated with an enterprise account already signed in through Authenticator. These tokens could then potentially be used to access the user’s organizational resources.
The vulnerability stems from an Authenticator component called AccountChooserActivity, which can be invoked by other applications on the device. The authorization process relies on information about the application claimed to be making the request but does not properly incorporate the identity of the application that actually initiated the request when deciding whether to issue a token. As a result, a malicious application can impersonate a legitimate Microsoft application installed on the device. During testing, researchers were able to obtain a Microsoft Graph access token with permissions to access corporate email, files, and calendar data. Microsoft stated that exploitation requires a malicious application to already be installed on the device and that the user must complete an authentication step in Authenticator. However, researchers reported that their Proof-of-Concept (PoC) could obtain a token without additional user interaction if an enterprise account was already signed in through Authenticator.
Users of Microsoft Authenticator on Android should verify that they are running version 6.2606.4246 or later and update as soon as possible. Users should also avoid installing applications from untrusted sources. Organizations managing Android devices should enforce a minimum Authenticator version through Mobile Device Management (MDM) and review applications installed on managed devices. Microsoft stated that it has not observed exploitation of the vulnerability in the wild.
Source: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html