CVE-2026-80097

Microsoft Authenticator Android Flaw Fixed After Permissionless Token Theft

Microsoft has patched a security vulnerability in the Authenticator app for Android that permitted malicious applications with no permissions to pose as trusted Microsoft apps, such as Teams, and collect sign-in tokens for a victim's work account. The flaw, tracked as CVE-2026-80097, was addressed in Authenticator for Android version 6.2606.4246. Users are advised to update the application immediately to mitigate the risk of unauthorized access to work accounts.