Microsoft has resolved a security vulnerability in its Authenticator app for Android, tracked as CVE-2026-80097. This flaw allowed malicious applications, even those without any permissions, to impersonate legitimate Microsoft apps like Teams.
The vulnerability enabled these malicious apps to collect sign-in tokens for a victim's work account. Microsoft has fixed this issue in version 6.2606.4246 of the Authenticator app for Android, and users are advised to update their application.
Sources and references
Original report
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 0081M5MU
Cite this
APA
Interestana AI Editorial. (2026, October 27). Microsoft Authenticator Flaw Exposed Work Account Tokens. Interestana. https://interestana.com/articles/microsoft-authenticator-flaw-let-permissionless-android-apps-steal-work-account-tokens-0081m5mu
MLA
“Microsoft Authenticator Flaw Exposed Work Account Tokens.” Interestana, 27 Oct. 2026, interestana.com/articles/microsoft-authenticator-flaw-let-permissionless-android-apps-steal-work-account-tokens-0081m5mu.
Chicago
Interestana AI Editorial. “Microsoft Authenticator Flaw Exposed Work Account Tokens.” Interestana, October 27, 2026. https://interestana.com/articles/microsoft-authenticator-flaw-let-permissionless-android-apps-steal-work-account-tokens-0081m5mu.
BibTeX
@misc{interestana_0081m5mu,
author = {{Interestana AI Editorial}},
title = {{Microsoft Authenticator Flaw Exposed Work Account Tokens}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/microsoft-authenticator-flaw-let-permissionless-android-apps-steal-work-account-tokens-0081m5mu},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html}
}Credit the source
Original reporting: The Hacker News, “Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens”, https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe