⚡ Key Highlights
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a v
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.
Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update.
In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.
The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important."
On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, and Authenticator hands back a token, a digital pass that proves the user is logged in. Because the broker controls access to the entire account, it should be careful about which app it grants a token to.
The flaw let the wrong app get one. Authenticator exposes a component, an activity named AccountChooserActivity, that any app on the device can start. When the attacker's app started it, Authenticator built its token request from values the attacker's app supplied, including the name of the app it claimed to be. The app said it was Teams, and the broker believed it.
A signature check was supposed to stop this, but it did not. The check looked up the real signature of the app being impersonated and confirmed the request matched it. Because Teams was genuinely installed on the device, its real signature was there to read, so the check passed.
Authenticator could also see which app had actually made the request, Enclave found, but it did not use that to decide whether to hand over a token.
Journalistic Attribution: Reported via The Hacker News for public informational purposes under Fair Use. Read the original primary report →
Copyright of original reporting belongs to The Hacker News. Contact support@cubiqinfotech.com for DMCA inquiries.
