Ethical Hacking News
Researchers have discovered a critical flaw in Microsoft Authenticator for Android that allows malicious apps to steal work account tokens. The vulnerability, tracked as CVE-2026-80097, has been fixed in the latest update, but organizations are urged to update their devices to prevent exploitation.
Microsoft Authenticator for Android is vulnerable to a critical flaw (CVE-2026-80097) that allows malicious apps to pose as trusted Microsoft apps and collect sign-in tokens for a victim's work account. The vulnerability arises from a component in Authenticator that allows any app on the device to start a specific activity, which can be exploited by malicious apps. The fix has been released in version 6.2606.4246, but the impact on existing tokens obtained by malicious apps is still unclear. The vulnerability highlights the importance of careful app management, secure authentication processes, regular software updates, and user vigilance in app security.
A recent vulnerability discovered in Microsoft Authenticator for Android has left the mobile security community reeling, as it allows malicious apps with no permissions to pose as trusted Microsoft apps, such as Teams, and collect sign-in tokens for a victim's work account. This critical flaw, tracked as CVE-2026-80097, has been fixed in Authenticator for Android version 6.2606.4246, and organizations are urged to update their devices to prevent exploitation.
The vulnerability arises from a component in Authenticator, an activity named AccountChooserActivity, which allows any app on the device to start it. When an attacker's app starts this activity, Authenticator builds its token request from values supplied by the attacker's app, including the name of the app it claims to be. In this case, the attacker's app claimed to be Teams, and the broker believed it, effectively granting access to the account's email, files, and calendar.
The flaw was discovered by researchers at Enclave, who published their technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, indicating it as "Important." According to Microsoft, exploitation requires the installation of a malicious app on the device and convincing the user to complete an authentication flow in Authenticator. However, Enclave reported that in their tests, the tokens were obtained without any user interaction, other than the presence of a signed-in account.
Microsoft has taken steps to fix the vulnerability, releasing an updated version of Authenticator for Android, version 6.2606.4246, which is available for download. Organizations that manage Android devices can require that minimum version through their device management. However, the fix's impact on existing tokens obtained by malicious apps is still unclear.
This vulnerability highlights the importance of careful app management and the need for secure authentication processes. As the use of cloud-based services and mobile apps continues to grow, so does the need for robust security measures to protect user accounts.
The discovery of this vulnerability also underscores the importance of regular software updates and the need for users to keep their apps up-to-date. In this case, the update to Authenticator for Android version 6.2606.4246 is crucial in preventing exploitation of the vulnerability.
In conclusion, the Microsoft Authenticator flaw exposed in Android highlights the need for vigilance in app security. Organizations and users must take proactive measures to update their devices and ensure that all apps are secure to prevent exploitation of such vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Authenticator-Flaw-Exposed-A-Gaping-Hole-in-Android-App-Security-Allows-Malicious-Apps-to-Steal-Work-Account-Tokens-ehn.shtml
https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-80097
https://www.cvedetails.com/cve/CVE-2026-80097/
Published: Tue Oct 27 07:25:55 2026 by llama3.2 3B Q4_K_M
