NewsThe Hacker News27.10.2026

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,

CVE-2026-80097Microsoft Apps: unzureichende Authentifizierung
CVE-2026-80097Microsoft Apps: Mehrere Schwachstellen ermöglichen Privilegieneskalation
CVE-2026-80097Microsoft Apps: unzureichende Authentifizierung
CVE-2026-80097Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097)
CVE-2026-80097Microsoft Authenticator Elevation of Privilege Vulnerability

Affected vendors and products

Microsoft Microsoft Authenticator
Microsoft Microsoft Authenticator For Android

Source: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

Linked advisories

Affected vendors and products