Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has patched a vulnerability in its Authenticator app for Android, tracked as CVE-2026-80097. The flaw allowed a malicious app with no special permissions to impersonate trusted Microsoft applications such as Teams. By exploiting this vulnerability, an attacker could collect sign-in tokens associated with a victim's work account. The fix was released in Microsoft Authenticator for Android version 6.2606.4246. Users are strongly advised to update to the patched version immediately. The vulnerability posed a significant risk to enterprise environments relying on Microsoft Authenticator for multi-factor authentication. No permissions were required for the malicious app to carry out the attack, lowering the barrier for exploitation significantly.