Covered by 2 outlets — first reported by Help Net Security, Oct 27, 06:14 UTC
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
Summary
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no special permissions pose as a trusted Microsoft app such as Teams and collect sign-in tokens for a victim's work account, The Hacker News reports. Help Net Security says researchers at Enclave found the problem, which exploited Authenticator's role as a broker that signs users in for Microsoft apps, and that no tap from the user was needed. The Hacker News says the flaw is tracked as CVE-2026-80097 and fixed in Authenticator for Android version 6.2606.4246.
AI summary by the SecurityTabs newsroom, checked against Help Net Security, The Hacker News. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
Help Net SecurityFirst report
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.
The Hacker News
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.