Microsoft patches critical Authenticator flaw that let Android apps steal session tokens

The flaw, tracked as CVE_2026-80097, was found by security researchers at Enclave. Microsoft Security Response Center confirmed the issue and released a fix, and Microsoft said Authenticator for Android versions earlier than 6.2606.4246 are affected. Users should update to version 6.2606.4246 or later through the Google Play Store, according to TechRadar.

In a controlled experiment, Enclave researchers used an Android device logged into a Microsoft service with Authenticator installed, then installed a third app that did not request extensive permissions or contact a suspicious server. The app pretended to be the legitimate Microsoft Teams app and supplied the required package name, client ID and redirect URI. Authenticator checked that the data was real but not the nature of the app providing it, and issued a session token. The login attempt was handled in the background without victim confirmation or notification.

With those tokens, the researchers gained access to emails, Teams chat messages, calendars and files, and were able to modify and send messages, alter files and calendar entries, and manage certain authentication methods, including creating or deleting passkeys. Enclave said an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens.

Enclave found no evidence that the attack was used in the wild and created it in a controlled environment. The malicious app would still need to land on the target Android device, and such apps are unlikely to enter the Google Play Store; users were advised to avoid downloading shady .APK files from unvetted app stores.