Microsoft Authenticator Bug on Android Let Rogue Apps Pose as Teams and Collect Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that allowed a malicious app with no special permissions to pretend to be a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. The issue is tracked as CVE-2026-80097 and was fixed in version 6.2606.4246, so anyone using the app should update. Microsoft rated it 8.6 on the CVSS scale and labels it "Important".

On Android, Authenticator also acts as a broker. When Teams or Outlook needs to sign a user in, it asks Authenticator, which hands back a token, a digital pass proving the user is logged in. Researcher Ofek Levin, working through a fellowship program at security firm Enclave, found that the app built its token request from values supplied by the calling app, including the name of the app it claimed to be. A signature check meant to stop impersonation passed because the real Teams app was installed on the device. Enclave also found Authenticator could see which app had actually made the request but did not use that to decide whether to issue a token.

In Enclave's tests, the tokens gave access to email, files and calendars. Microsoft says exploitation also requires the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks. The tokens apply only to the work account signed into Authenticator on that device. Enclave published its technical details on October 23, 2026.