Microsoft Authenticator Android flaw exposed session tokens

A vulnerability in Microsoft Authenticator for Android allowed malicious apps to obtain session tokens for Microsoft apps, according to TechRadar. The flaw is tracked as CVE-2026-80097 and has been fixed.

Security researchers at Enclave found that an app with no special permissions could impersonate an installed Microsoft app, such as Microsoft Teams, and ask Authenticator for a token. The test app supplied a package name, client ID and redirect URI that Authenticator accepted. The user did not need to approve the login, and the researchers said the attempt ran in the background without notifying the user.

With a token, the researchers accessed email, Teams chats and calendars, and could modify or send messages and alter files and calendar entries. They also reported being able to manage some authentication methods, including creating or deleting passkeys.

Enclave said it found no evidence of the attack being used in the wild. It reported the issue to the Microsoft Security Response Center, which confirmed the vulnerability and released a fix. Microsoft said Android versions earlier than 6.2606.4246 are affected and urged users to update to version 6.2606.4246 or later through the Google Play Store.