An exported Android activity in Microsoft Authenticator allowed malicious applications to silently steal authentication tokens for signed-in work accounts without requiring user interaction or standard Android permissions, Help Net Security reported.
The flaw, tracked as CVE-2026-80097 with a high-severity CVSS score of 8.6, exposed enterprise resources across Microsoft 365. Security researcher Ofek Levin, participating in the Enclave fellowship program, identified the vulnerability. CyberPress noted that the weakness specifically involved com.microsoft.identity.client.AccountChooserActivity, an exported component designed to function as a token broker for downstream applications like Microsoft Teams and Outlook.
Flawed Validation in the Token Broker Architecture
Microsoft Authenticator manages authentication tokens by issuing digital passes to requesting applications on the Android OS. However, the software’s underlying authorization logic accepted critical identity parameters directly from intent extras supplied by the calling process.
We got Microsoft Authenticator to hand over account tokens to a fake Teams app.The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking. The result: full delegated access to mailbox, files, and calendar…
PhoneWorld.com.pk highlighted that the vulnerable implementation relied on information provided by the requesting app itself, including the claimed package name, client ID, redirect URI, requested scopes, and caller UID. Although Android provides system-level mechanisms to verify the true caller identity, Authenticator failed to enforce this verification in its authorization decisions.
Instead, the validation routine checked whether the supplied redirect URI matched the signature-derived redirect URI for whichever package the caller claimed to be. An attacker could retrieve public package details for a legitimate installed application, such as Teams, and supply matching values to satisfy the check.
CyberPress reported that the application accepted requests without confirming that the legitimate client had actually initiated them. The broker then returned sensitive authentication material—including access tokens, refresh tokens, ID tokens, and client details—directly within the activity result bundle.
Scope of Enterprise Exposure and Attack Vectors
In proof-of-concept testing, researchers demonstrated that impersonating Microsoft Teams allowed unauthorized apps to request Microsoft Graph permissions. This delegated access granted capabilities such as reading and writing emails, sending messages, managing calendar entries, accessing OneDrive files, and navigating SharePoint sites.
Ofek Levin demonstrated that impersonating different Microsoft clients could return tokens with elevated scopes, including access to authentication methods and passkey operations. This enabled an attacker to create or delete passkeys on the victim’s account, ensuring persistent unauthorized access even after the malicious application was removed from the device.
The attack vector required no user prompts, warnings, or device permissions beyond having a malicious application installed alongside Authenticator on the same Android device.
🚨 CRITICAL ANDROID SECURITY FLAW: A MALICIOUS APP COULD STEAL YOUR MICROSOFT WORK ACCOUNT TOKENS Due to a flaw in Microsoft Authenticator.CVE-2026-80097 exposes a dangerous vulnerability in Microsoft Authenticator that could let a rogue Android app hijack authentication token…
Microsoft Releases Patch for Authenticator for Android Vulnerability
Microsoft confirmed the vulnerability and released a patch on September 8, 2026, designated as CVE-2026-80097 and classified under CWE-287 for improper authentication. All Authenticator for Android versions prior to 6.2606.4246 are affected by the flaw.
Organizations managing enterprise Android fleets must enforce updates through mobile device management tools to ensure endpoints run version 6.2606.4246 or later. Security teams are advised to monitor for unusual refresh-token usage, unexpected delegated Graph API activity, and account access originating from unfamiliar mobile clients.
Microsoft Authenticator for Android had a flaw that let apps with zero permissions steal work tokens. Here's what you need to know.Microsoft patched a high-severity bug, CVE-2026-80097, in Authenticator for Android. The CVE record, dated Sep 8, describes it as improper… https://t.co/eUcbKbR7yl pic.twitter.com/rZEAvmemAr
The apps that are supposed to protect you are the best attack vectors. We pointed our agents at Microsoft Authenticator:We discovered any Android app with zero permissions could say “I’m Teams” and capture your tokens. Mail, files, calendar.Huge find by @ofekdavidlevin https://t.co/igkQhlUu4T
