A Microsoft Authenticator bug let silent Android apps grab work logins
Microsoft has patched a flaw in its Authenticator app for Android that let a sneaky app with zero permissions impersonate Teams and walk off with sign-in tokens for someone's work account.
Key points
- A flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097, let a malicious app with no Android permissions pose as Microsoft Teams and steal sign-in tokens for a victim's work account.
- Microsoft fixed the bug in Authenticator for Android version 6.2606.4246, released alongside the advisory on 8 September 2026.
- The flaw is an improper authentication issue that leads to local privilege escalation, according to the National Vulnerability Database entry for CVE-2026-80097.
- MFA prompts from Authenticator would not have saved the victim here, because the stolen token already proved the user had signed in.
- Users need only update the Authenticator app from the Google Play Store; IT teams should verify managed devices are on the fixed build.
Microsoft has quietly patched a nasty bug in the Android version of its Authenticator app, the little green shield that millions of office workers tap every morning to prove they are who they say they are.
The flaw let a second app on the same phone pretend to be a genuine Microsoft client and ask Authenticator to hand over a sign-in token for the user's work account. A sign-in token is the digital stamp that says a person has already logged in and passed their MFA check, so whoever holds it can act as that user without a password and without a second prompt.
The malicious app needed no Android permissions at all. No contacts, no storage, no camera. Nothing that would make a cautious user say no on install. That's the part that stings.
What exactly did the flaw do?
The bug sat in how Authenticator checked which app was asking it for a token. Rather than properly verifying the caller, it accepted a weak claim of identity, so a rogue app could present itself as Teams or another trusted Microsoft client and be believed.
Once believed, Authenticator released a token tied to the victim's corporate account. From the company's point of view, the sign-in that followed looked like the real employee on their real phone. The National Vulnerability Database classifies it as improper authentication leading to local privilege escalation. In plain terms: one app on the handset gets to act with the authority of a more trusted one.
Which version is safe?
Authenticator for Android 6.2606.4246 and later contain the fix. Earlier builds are vulnerable. Microsoft published the advisory on 8 September 2026, and the Play Store update went out the same week.
| Item | Detail |
|---|---|
| CVE | CVE-2026-80097 |
| Affected app | Microsoft Authenticator for Android |
| Fixed version | 6.2606.4246 |
| Advisory date | 8 September 2026 |
IOS users aren't listed as affected. The issue is specific to how Android lets apps talk to each other.
Would MFA have helped the victim?
No, and that's the uncomfortable part. The attack's whole purpose was to lift a token that already represented a completed MFA check. The attacker didn't need to answer a push notification or tap a fingerprint reader. They just asked the right app the right question in the right costume.
This is a running theme on the identity beat. Our story on attackers logging in rather than breaking in made the same point on 19 September: once a token is in hand, another login screen doesn't help. Phishing-resistant methods such as passkeys and hardware security keys protect the moment of login. They don't, on their own, protect tokens once those tokens are sitting on a device that also runs untrusted software.
What should ordinary users do?
Open the Google Play Store, search for Microsoft Authenticator, and hit update. If the version shown is 6.2606.4246 or higher, you're done. Work phones managed by an employer may already have the update queued, but a manual check costs nothing.
For IT teams, the useful move is confirming the fixed build is deployed across the fleet and reviewing sign-in logs for Microsoft client logins from devices carrying unfamiliar apps. The Hacker News, which first drew wider attention to the researchers' write-up, noted the attack worked in lab tests against a stock handset with no exotic setup.
One quiet lesson here: Authenticator is now a high-value target in its own right, not just a convenience layer. Treat its updates the way you treat browser patches. Promptly.
