A flaw in Microsoft Authenticator for Android could let a malicious app on the same phone pretend to be Microsoft Teams and walk away with tokens for the owner's work account, giving it access to their email, files and calendar. Microsoft has fixed the bug, tracked as CVE-2026-80097, in Authenticator version 6.2606.4246.
The issue was found by researchers at Enclave, who published their technical findings on October 23, 2026, and is summarised in an advisory from Rewterz. Microsoft assigned the CVE on September 8, rates it Important, and gives it a CVSS score of 8.6. The company says the flaw has not been exploited in attacks and considers exploitation less likely.
A broker that checked the wrong app's signature
On Android, Authenticator does more than show codes. It acts as an authentication broker, handing out sign-in tokens to Microsoft apps such as Teams and Outlook so users do not have to log in to each one separately. That makes it a valuable target: whoever can convince the broker it is Teams gets what Teams gets.
According to the research, Authenticator exposed a component called AccountChooserActivity that any app on the device could call to start an authentication request. A malicious app could shape that request to impersonate a legitimate Microsoft app. When Authenticator checked who was asking, it verified the signature of the app being impersonated rather than the app actually making the request, so the check passed as long as the real app was installed on the phone.
The reward was Microsoft Graph access tokens with permission to read and send email, read and modify files, and read and change calendar entries for the work account signed into Authenticator.
The vendor and the researchers disagree on clicks
There is one open dispute. Enclave reported obtaining tokens without direct user interaction, while Microsoft says exploitation requires the victim to complete an authentication flow. Either way, an attacker first needs a malicious app installed on the target's phone, which is the main brake on this bug.
Stolen Microsoft 365 tokens are already a well-worn route into companies, as IntelFusions has reported with point-and-click token theft tooling. A bug that lets an ordinary-looking app request those tokens directly from the broker removes the need for phishing altogether.
Update Authenticator to 6.2606.4246 or later
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later, and enforce that minimum version through mobile device management.
- Review Microsoft Graph activity for unusual mailbox access, file changes and calendar operations tied to mobile sign-ins.
- Remove unknown or sideloaded apps from managed Android devices, and revoke sessions and refresh tokens for any account where compromise is suspected.
No exploitation has been reported, so this is a patch-and-verify job rather than an incident. But it is a reminder that on a shared phone, the app that holds everyone's keys is only as safe as its idea of who is asking.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.