Microsoft Authenticator Android Flaw (CVE‑2026‑80097) Lets Permission‑less Apps Steal Work Account Tokens

What happened

Microsoft released a patch for CVE‑2026‑80097, a flaw in its Authenticator Android app that allows a malicious app with no declared permissions to impersonate trusted Microsoft applications such as Teams. By exploiting improper intent‑filter validation, the attacker can capture OAuth tokens for a victim’s work account, potentially enabling unauthorized access to corporate resources. The vulnerability was demonstrated in a lab environment, prompting Microsoft to issue version 6.2606.4246 as the remediation. Until devices are updated, any user of the vulnerable app is exposed to token theft.

Why it matters for trust and compliance

• The issue maps to the access‑control control objective of protecting credential artifacts and ensuring token issuance is monitored—key for audit readiness across frameworks like NIST CSF 2.0.
• Demonstrates the need for continuous monitoring of mobile app versions as part of credential‑protection controls.
• Provides evidence that token‑handling processes must be auditable to satisfy control‑assurance requirements.

Who is affected

Recommended actions

1. Update Microsoft Authenticator to version 6.2606.4246 or later on all Android devices.
2. Enforce MDM policies that whitelist approved apps and block sideloading of unknown packages.
3. Enable detailed logging of token issuance and monitor for anomalous authentication patterns.
4. Perform an inventory sweep to identify devices still running the vulnerable version and remediate immediately.

Details

CVEs

CVE-2026-80097