Microsoft Authenticator Flaw Allowed Malicious Android Apps to Steal Account Tokens
A critical vulnerability in Microsoft Authenticator for Android allowed malicious apps to steal work account access tokens without requiring any permissions.
Microsoft has patched a significant security flaw, CVE-2026-80097, in its Authenticator application for Android devices. This vulnerability, rated with a CVSS score of 8.6, allowed malicious applications with no declared permissions to steal access tokens for work accounts. The issue stemmed from an improper authentication mechanism within the app's broker component, enabling untrusted apps to impersonate legitimate Microsoft applications.
Researchers from Enclave discovered that an attacker could craft a request to the Authenticator app, claiming to be a trusted Microsoft application like Microsoft Teams. This forged request could trick the Authenticator's broker into issuing delegated tokens for that identity. Crucially, this process did not require user approval, account credentials, or any special Android permissions beyond the attacker app simply being installed on the device.
The core of the vulnerability lay in an exported Android activity, com.microsoft.identity.client.AccountChooserActivity. This activity was designed to accept broker requests from other applications. While Authenticator performed a signature-related validation on the redirect URI, it focused on the claimed identity in the request rather than verifying the actual caller. An attacker could supply the necessary fields, including a claimed app package name and client ID, and if the claimed identity (e.g., Teams) was legitimately installed, the validation check could be passed.
Successful exploitation meant that the vulnerable activity could return sensitive token data, including access tokens and refresh tokens, through the activity result bundle. The impact of these stolen tokens could be severe, potentially granting attackers access to a wide range of Microsoft Graph resources. Depending on the impersonated Microsoft client and the requested scopes, this could include access to mailboxes, calendars, OneDrive files, SharePoint content, and Microsoft Teams data.
To demonstrate the risk, researchers successfully impersonated multiple Microsoft applications. For instance, an attacker impersonating Teams could obtain delegated permissions allowing them to read and write emails, send messages, access files, and modify calendars. This poses a significant threat to organizations that rely on Android devices for accessing Microsoft 365 workloads.
Microsoft addressed this vulnerability by releasing version 6.2606.4246 of Microsoft Authenticator for Android in July 2026. Users and organizations are strongly advised to update the application immediately via the Google Play Store and ensure that managed devices are running the latest version. Microsoft's official advisory classifies the issue as improper authentication leading to potential local privilege elevation.
This incident underscores the critical importance of mobile identity brokers rigorously validating the true calling application, including its package identity, UID, and signing certificate, rather than relying solely on app-provided values within an intent. It also highlights Microsoft's ongoing efforts to secure Entra credentials on mobile devices, where malware and weakened security controls can amplify enterprise identity risks.
Organizations should review their mobile application management policies, enforce timely app updates through Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) platforms, and consider restricting the installation of sideloaded applications. Monitoring for unusual Microsoft Graph activity, unexpected consent prompts, and token usage from unfamiliar Android devices is also recommended.