A critical vulnerability in the Android version of Microsoft Authenticator (CVE-2026-80097) allowed a permissionless Android app to impersonate a trusted Microsoft app and obtain sign-in tokens for a victim’s work account, including access to mail, calendars, OneDrive, SharePoint, and Teams.

Microsoft fixed the flaw and urged Android users to update the Authenticator app immediately to mitigate the risk, with the fix shipping in version 6.2606.4246 in July 2026.

There remains uncertainty whether updating revokes tokens already obtained by a malicious app, as sources do not explicitly confirm this.

If exploited, the attacker could surface tokens such as access, refresh, and ID tokens, granting permissions to Microsoft Graph resources tied to the victim’s account.

Advisory guidance emphasizes improper authentication and the need for mobile identity brokers to validate the real calling application, including package identity, UID, and signing certificate, not just app-controlled values.

Security teams should stay updated on new malware and incorporate threat intel feeds to strengthen defenses against related threats.

An untrusted app could impersonate a legitimate Microsoft app (for example, Teams) in a broker request, providing fields like package name, client ID, redirect URI, scopes, and caller UID without user approval or device permissions.

The flaw stemmed from Authenticator acting as a token broker and failing to verify the actual caller app, instead trusting the app’s self-declared identity.

Authenticator validated only the claimed identity in the request and did not confirm the legitimate caller, enabling token theft via delegated permissions.

Researchers demonstrated that a malicious app could pose as Teams to steal tokens and read/write emails, access files and calendars, and even send Teams messages, or alter sign-in methods by spoofing the authenticator.

The attack required a malicious app to be installed and the user to complete an authentication flow, with token theft potentially occurring silently and without prompts.

The vulnerability involved the broker component, specifically an exported activity named com.microsoft.identity.client.AccountChooserActivity, which could be triggered by any app on the device to obtain authentication results.