HighMalwareCVE-2026-80097
Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions
Cyber Security News·Source published ·1 min read
What happened?
Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component. Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account.
Key details
- Microsoft patched a high-severity flaw in Authenticator for Android that let malicious apps steal work account tokens without any declared permissions.
- Successful exploitation returned access tokens, refresh tokens, ID tokens, and client information that could access Microsoft Graph resources.
- Impact could extend to mailboxes, calendars, OneDrive files, SharePoint content, and Teams services depending on the impersonated client and scopes.
- Microsoft fixed the issue in Authenticator for Android version 6.2606.4246 released in July 2026 and urges users to update via Google Play.
Affected
- Android devices with Microsoft Authenticator installed and a signed-in work account.
What to look for
- Unusual Microsoft Graph activity from unfamiliar Android devices.
- Unexpected consent behavior in Microsoft 365 workloads.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.