Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens Without Any Permissions | CVE-2026-80097 | CVSS 8.6
Microsoft has patched a high-severity flaw in Authenticator for Android, CVE-2026-80097, rated CVSS 8.6, that could let a malicious app steal work-account access tokens. Researchers at Enclave found an untrusted app could impersonate a trusted Microsoft app such as Teams and ask Authenticator to issue a token for that identity, exploiting improper authentication in an exported Android activity. The danger is the scale of the shortcut: the request needed no user approval, no account credentials and no Android permissions, only that the malicious app be installed on a device where Authenticator and a work account were present.
SOURCES
- LinuxDo2026-10-27 01:21