Published on October 27, 2026
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Severity
High
Detail
Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component.
Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account. In the researchers’ tests, the tokens gave full access to the account’s email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.
| CVE ID | Summary | CVSS Score |
| CVE-2026-80097 | An improper authentication vulnerability in Microsoft Authenticator that enables local privilege escalation. An unauthorized attacker with local access can bypass authentication checks to elevate privileges on an affected system. | 8.6 (High) |
Affected Products
- Microsoft Authenticator for Android – Older than version 6.2606.4246
Recommendation
- Organizations and individual users should update the app through Google Play as soon as possible and verify that managed devices are running a current release.
- Inventory endpoints and mobile devices running Microsoft Authenticator and prioritize patching for privileged users and administrators.
- Educate users to reject unexpected authentication prompts, since exploitation requires user interaction.
Source
https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097