Microsoft Authenticator vulnerability let rogue Android apps steal work account access

If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.

Here’s what happened

Authenticator does more than show six-digit codes. On Android it also acts as a “broker.” When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator hands back a token: a digital pass that proves you’re logged in. Because Authenticator controls access to your whole Microsoft account, it’s supposed to be very careful about which apps it gives those tokens to.

Ofek Levin, a researcher on Enclave’s fellowship program, found that it wasn’t careful enough. One part of Authenticator could be opened by any app on the device. When an app asked it for a token, Authenticator didn’t check which app was actually asking. It trusted what the app said about itself.

So a malicious app could say “Hi, I’m Teams” and get Teams’ tokens. Authenticator did run a check, but it was easy to fake. The check confirmed that the details in the request matched the real Teams app installed on the phone, and any app can read those details. Authenticator knew which app was really calling. It just never used that information to decide whether to trust it.

The impact was serious

With one work account signed into Authenticator, the researchers’ test app got tokens that could:

• Read and send email from the victim’s mailbox
• Read and change their files, calendar and SharePoint sites
• Send Teams messages as them
• By pretending to be Authenticator itself, change the account’s sign-in methods, including creating and deleting passkeys

An attacker who can add their own passkey to your account can keep getting in after you’ve removed the malicious app.

The attack still needed a malicious app on the device, so someone would have to be tricked into installing one. But once that happened, the theft was silent. No prompt, no warning, nothing to see.

The good news: it’s fixed

Enclave reported the flaw to Microsoft through responsible disclosure. Microsoft confirmed it and released a fix, tracked as CVE-2026-80097 and published on September 8, 2026. Microsoft rated it CVSS 8.6. All Authenticator for Android versions before 6.2606.4246 are affected.

What to do

• Update Microsoft Authenticator from the Google Play Store. Check that you’re on version 6.2606.4246 or later.
• If you manage company devices, make sure your MDM enforces that minimum version.
• As always, be careful about sideloading apps or installing unfamiliar ones from outside trusted stores.