Microsoft Authenticator Vulnerability Allows Token Theft by Malicious Apps

• •CVE-2026-80097 allows token theft by malicious apps without permissions.
• •The vulnerability affects Android devices with Microsoft Authenticator and work accounts.
• •Microsoft has issued a patch to fix the high-severity flaw.

A security flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097, allows malicious apps to steal authentication tokens without requiring any permissions. This high-severity vulnerability, with a CVSS score of 8.6, was discovered by security researchers at Enclave and is classified as a local privilege escalation issue. The flaw affects Android devices with Microsoft Authenticator installed and a signed-in work account. Attackers can impersonate trusted Microsoft applications, like Microsoft Teams, to request authentication tokens. The vulnerability stems from improper verification of the requesting application's identity in the app's broker component. Microsoft has released a patch to address this issue, which could expose sensitive Microsoft 365 data if exploited. The attack does not require user approval or additional permissions, making it particularly concerning for users of the app.