Microsoft patches a severe flaw in its Android Authenticator app that could let untrusted apps impersonate Microsoft apps and obtain delegated account tokens

If you use Microsoft Authenticator on Android, your work account access tokens are now more secure from malicious apps. A critical flaw allowed unapproved apps to steal them, which has now been fixed.

Microsoft has patched a critical vulnerability (CVE-2026-80097) in its Android Authenticator app, rated CVSS 8.6. This flaw allowed malicious Android applications with no declared permissions to impersonate trusted Microsoft apps, such as Microsoft Teams, and request delegated account access tokens. The vulnerability exploited an improper authentication mechanism in the app's broker component. Attackers could trick the Authenticator app into issuing tokens by providing forged application details like package name and client ID, bypassing the need for user approval or device permissions. This would grant attackers access to sensitive Microsoft 365 data, including emails, files, and calendar entries, depending on the impersonated application and its granted permissions. The vulnerability was fixed in Microsoft Authenticator for Android version 6.2606.4246, released in July 2026.

This vulnerability underscores a significant risk in how mobile identity brokers validate incoming requests. The core issue was the Authenticator app trusting self-reported application details instead of verifying the actual calling application's identity. This oversight allowed attackers to leverage the app's existing functionality to steal sensitive tokens, granting them access to a wide range of Microsoft 365 resources. The reliance on impersonation of legitimate Microsoft applications highlights the sophistication of potential attacks targeting enterprise credentials on mobile devices.

The successful exploitation of this flaw emphasizes the critical need for robust security measures in mobile applications, particularly those handling authentication and sensitive data. Organizations should ensure their Android devices are running the latest version of Microsoft Authenticator and enforce timely updates via MDM/EMM solutions. Continuous monitoring for unusual Microsoft Graph activity and unexpected token usage from mobile devices will be crucial for detecting and mitigating potential post-patch compromises or future attacks.