Critical Microsoft Authenticator Flaw Allowed Android Apps to Steal Session Tokens

Overview of the Microsoft Authenticator Vulnerability

Security researchers discovered a critical vulnerability in the Microsoft Authenticator app for Android, tracked as CVE-2026-80097. The flaw allowed unprivileged malicious Android apps to impersonate trusted Microsoft applications and acquire session tokens without requiring user interaction, extensive permissions, or stolen login credentials.

According to reports from Enclave researchers, the vulnerability enabled rogue apps to request and receive access tokens by simply presenting correct package names, client IDs, and redirect URIs. The Authenticator app verified the supplied data parameters but failed to validate the identity of the requesting application itself. Consequently, any app could masquerade as a trusted service like Microsoft Teams in the background without triggering user notifications or consent prompts.

Potential Impact and Scope

• Unauthorized access to emails, calendars, and files.
• Ability to read and send Microsoft Teams chat messages.
• Modification of certain authentication methods, including passkey creation and deletion.

Researchers noted that this method bypassed typical warning signs of malicious software because no dangerous permissions were requested. However, investigators emphasized that the demonstration was conducted in a controlled environment, and there was no confirmed evidence of active exploitation in the wild prior to the patch release.

Verification and Recommended Actions

Microsoft has addressed the security issue and urged all Android users to update their software immediately.

• Affected Versions: Microsoft Authenticator for Android versions earlier than 6.2606.4246.
• Resolution: Update to version 6.2606.4246 or later via the official Google Play Store.
• Prevention: Refrain from downloading unverified APK files from third-party app stores to reduce the risk of malicious software installation on mobile devices.