Microsoft Authenticator Android Token Theft Flaw Patched

Introduction

Microsoft has resolved a significant security issue in its Authenticator app for Android that could have allowed malicious applications to silently harvest work account credentials. The vulnerability, tracked as CVE-2026-80097, enabled apps with no special permissions to impersonate trusted Microsoft services such as Teams and collect active sign-in tokens from a victim's device. The fix was delivered in Authenticator for Android version 6.2606.4246, and all users are advised to update immediately to protect their enterprise identities.

Understanding the Token Theft Mechanism

The flaw exploited a trust relationship between the Authenticator app and other Microsoft services installed on the same device. Normally, the Authenticator app relies on verified package signatures and known application identifiers to ensure that token requests originate from legitimate Microsoft applications. However, researchers discovered that this verification process could be bypassed by a malicious app that did not require any dangerous permissions to operate. By mimicking the identity of a trusted Microsoft app, the attacker's software was able to request and receive authentication tokens that had already been issued to the user's work account. These tokens could then be used to access corporate resources, including email, cloud storage, and internal collaboration platforms, without requiring the user to re-enter their password or approve a new login attempt.

Scope and Potential Impact

Because the vulnerability existed within the Authenticator app itself, any organization that deployed the app for Android-based multi-factor authentication or single sign-on workflows was potentially at risk. The attack did not require the victim to install a suspicious app from an unknown source; rather, the malicious software could be distributed through standard app stores or bundled with seemingly benign applications. Once installed, the rogue app could operate in the background, gathering tokens whenever the user authenticated to supported Microsoft services. The collected tokens granted the attacker the same level of access as the compromised account, which in many cases included sensitive business data, internal communications, and administrative privileges if the user held an elevated role.

Who Is Affected and What Was Fixed

Organizations and individuals using Authenticator for Android prior to version 6.2606.4246 are affected by this vulnerability. Microsoft released the patched version through the Google Play Store, meaning that devices configured for automatic updates should receive the fix without user intervention. However, devices that have automatic updates disabled, or those managed by enterprise policies that delay app updates, may still be running a vulnerable version. The company has not disclosed technical details about the specific implementation flaw, citing responsible disclosure practices, but confirmed that the updated version includes enhanced validation checks to prevent unauthorized applications from requesting tokens on behalf of trusted Microsoft services.

Practical Mitigation and Next Steps

IT administrators should audit their mobile device management (MDM) or unified endpoint management (UEM) platforms to identify devices running outdated versions of the Authenticator app. Enforce automatic updates for all Microsoft mobile applications, particularly those involved in authentication workflows. Users should manually verify that their Authenticator app has been updated to version 6.2606.4246 or later by checking the app's information page in the Google Play Store. As an additional safeguard, review recent sign-in activity in Azure Active Directory for any unusual access patterns, especially from unfamiliar devices or applications. If suspicious tokens are detected, revoke active sessions and require users to re-authenticate using a fresh set of credentials.

Conclusion

The resolution of CVE-2026-80097 highlights the ongoing challenges of securing mobile authentication in enterprise environments. While Microsoft has addressed the immediate risk, the incident serves as a reminder that even trusted applications can become attack vectors when underlying assumptions about identity verification are not rigorously enforced. Organizations should treat this event as a catalyst for strengthening their mobile security posture through proactive updates, behavioral monitoring, and layered access controls. For enterprises seeking to automate threat detection and streamline secure identity management, Grivyonx's AI-powered security automation and DevSecOps integration services offer a scalable path forward.