Microsoft Authenticator Android Flaw Fixed After Permissionless Token Theft

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests, a malicious app lacking any permissions was able to impersonate a trusted Microsoft application and extract authentication tokens, potentially enabling account compromise. The vulnerability was discovered and reported in October 2026, with the fix rolling out to the updated version. The issue highlights the risks posed by seemingly benign applications operating with elevated trust levels without requiring explicit user permissions.