The Microsoft Authenticator flaw let a rogue Android app pick up your work account tokens without asking for a single permission. Microsoft patched it in September, so the fix is already out. Update to Authenticator 6.2606.4246 or newer and you’re covered.
Researchers at Enclave published the technical details on October 23, which is why it’s in the news now.
Here are the facts to know first:
- CVE-2026-80097, rated 8.6 (CVSS), which Microsoft calls “Important.”
- Affects Microsoft Authenticator for Android builds older than 6.2606.4246.
- Targets the work or school account signed in to the app.
- Microsoft says it hasn’t seen it used in real attacks.
- The fix: update the app from Google Play.
The short version is that this is a patch-and-move-on story, not a panic story.
What the Microsoft Authenticator flaw actually did
On Android, Authenticator doesn’t just generate codes. It also acts as a “broker” that hands sign-in tokens to other Microsoft apps like Teams and Outlook, so you don’t log in over and over.
That broker role is where the bug lived. A screen inside Authenticator, called AccountChooserActivity, could be opened by any app on the phone. It then built a token request from whatever details the calling app supplied.
The result, according to The Hacker News, was that a malicious app could ask for Teams’ tokens and get them.
How a fake Teams app got real tokens
Authenticator did have a safety check. It compared the request against the real Teams app’s signature. The catch is that the real Teams app was genuinely installed on the phone, so the check passed.
Enclave found that Authenticator could tell which app was actually calling. It just never used that fact to decide whether to hand over a token.
In the researchers’ tests, the stolen tokens could read and send email, open files, and touch calendars. Per Help Net Security, the test app could even change sign-in methods, including adding a passkey that would survive deleting the bad app.
Nothing in the process showed a permission prompt or warning. That silence is what made it nasty.
It also shows why brokers are such a tempting target. One app holds the keys for many others, so a single slip can open Mail, Files, Calendar and Teams at once. That’s the trade-off for not having to sign in everywhere.
Microsoft assigned the CVE on September 8, 2026, so the fix has been available for weeks. The public technical write-up from Enclave only followed on October 23.
Who is at risk, and how worried should you be?
Researchers and Microsoft describe the risk a little differently. This table puts the two views side by side.
| Question | Enclave researchers | Microsoft |
|---|---|---|
| Does it need user action? | Their proof of concept returned tokens with no steps beyond a signed-in account | Says the user must install a malicious app and complete a sign-in flow in Authenticator |
| Exploited in attacks? | Not reported | Says no, and rates exploitation “less likely” |
| Which accounts? | Work account signed in to Authenticator | Same |
| What fixes it? | Update to 6.2606.4246 or later | Same |
Either way, an attacker first needs a bad app on your phone. That’s why where you install apps from matters as much as the patch. Apps from outside Google Play, or ones that promise free premium features, deserve the most suspicion.
The reports we read only cover work accounts. They don’t say whether personal Microsoft accounts are affected, so we won’t guess. They also don’t say whether updating cancels tokens that were already taken, which is another reason to stay careful.
How to check your Authenticator version
It takes about a minute. Here’s what to do:
- Open Google Play and search for Microsoft Authenticator.
- Tap Update if you see it. Play updates apps in the background too, so you may already have it.
- Open Android Settings, then Apps, then Authenticator, and scroll down to see the version number.
- Confirm it reads 6.2606.4246 or higher.
If your phone is managed by your employer, your IT team can set a minimum app version through device management. It’s worth asking them whether they’ve done it.
While you’re at it, skim your app list for anything you don’t remember installing. Our piece on dormant AI agents that still hold live credentials covers the same lesson: old access you forgot about is the easiest thing to abuse. For stranger-danger on the messaging side, see Google Messages Enhanced Protection.
Frequently Asked Questions
Is the Microsoft Authenticator flaw still dangerous?
Not if you’ve updated. Versions 6.2606.4246 and later contain the fix, which Microsoft shipped as part of its September 2026 updates.
Was anyone hacked using this bug?
Microsoft says it wasn’t exploited before the fix and wasn’t publicly known. As of October 26, it wasn’t on CISA’s list of known exploited vulnerabilities.
Do I need to change my password?
Nothing in the reports says you must. If you’ve installed odd apps recently, though, changing your password and reviewing your account’s sign-in methods is a cheap precaution.
Does this affect Authenticator on iPhone?
The reports only describe the Android app. We haven’t seen anything saying iOS is affected.
Our take: update now, then tidy your apps
If you use Authenticator for work on Android, update today and don’t overthink it. The bigger lesson is that one weak check inside a trusted app can undo a lot of good security, so keep your phone free of apps you wouldn’t miss, and stick to Google Play.
Leave a Reply