Cyber Security News reports that CVE-2026-80097, a flaw in Microsoft Authenticator for Android, let a malicious app with no declared permissions obtain work account access tokens. The flaw carries a CVSS score of 8.6 and Microsoft classifies it as a local elevation-of-privilege issue. The exposure covers any Android device with Authenticator installed and a signed-in work account, so it matters most to IT teams running Microsoft 365 on Android.

Image shared by @The_Cyber_News on X
Image shared by @The_Cyber_News on X

Image credit: @The_Cyber_News on X

How the flaw works

Researchers at Enclave, including Ofek Levin according to cyberpress.org, found that an exported Android activity called AccountChooserActivity accepted broker requests from other apps on the device. The request included fields the caller supplied itself: a claimed package name, client ID, redirect URI, scopes and a caller UID.

Authenticator checked the redirect URI against the signature of the app the request claimed to be, such as Microsoft Teams. A malicious app could claim to be Teams, build a redirect URI from Teams' public signature and pass the check. The activity could identify the real caller but did not use that identity to decide trust.

Successful requests returned access tokens, refresh tokens, ID tokens and client information. Depending on the impersonated client and scopes, the reports say the access could reach mailboxes, calendars, OneDrive, SharePoint and Teams. In a proof of concept impersonating Teams, the researchers obtained delegated Microsoft Graph permissions to read and write mail, send messages, access files and modify calendars.

The coverage disagrees on user involvement. Cyber Security News and Cryptika say no user approval is needed. The Zero Day Initiative's September review says an attacker needs a malicious app on the device and a user to complete the authentication sequence, and the CVSS vector in Vulners lists user interaction as required.

Timing and affected versions

Microsoft published the advisory on September 8, 2026, about seven weeks before this coverage, so the fix is not new. GBHackers says Microsoft fixed the issue in Authenticator for Android 6.2606.4246, and that earlier versions are affected. A different affected range appears in Vulners' CNA data, which runs from 6.0.0 up to but not including 16.3.0. Check Microsoft's Security Update Guide entry for the exact range before relying on any build number.

What to do

Update Authenticator through Google Play and confirm that managed devices run the current build through your MDM or EMM platform. Restrict sideloaded apps where you can. Watch for unusual Microsoft Graph activity, unexpected consent grants and token use from unfamiliar Android devices, as the coverage recommends.

Our read: the lesson extends beyond Microsoft. A mobile identity broker should verify the calling app's package identity, UID and signing certificate, rather than trusting values the caller supplies in an intent.

Sources