Microsoft has patched a security vulnerability in its Authenticator app for Android, tracked as CVE-2026-80097, which could allow a malicious application to impersonate a trusted Microsoft app, such as Teams, and obtain authentication tokens for a victim’s work account. The vulnerability carries a CVSS score of 8.6 and is rated “Important” by Microsoft.

The flaw was discovered through a security research , which published its technical findings on October 23, 2026. Microsoft assigned the CVE on September 8, 2026, and addressed the issue in Microsoft Authenticator for Android version 6.2606.4246.

Microsoft Authenticator acts as an authentication broker for applications such as Teams and Outlook, issuing tokens that allow users to access Microsoft services. The vulnerability stemmed from an exposed component called AccountChooserActivity, which allowed any application on the device to initiate an authentication request. A malicious app could manipulate the request to impersonate a legitimate application.

According to research, Authenticator's signature verification mechanism failed to properly validate the identity of the application requesting a token. Instead, it checked the signature of the impersonated application, allowing the request to pass when the legitimate app was installed on the device.

Successful exploitation could allow attackers to obtain Microsoft Graph access tokens with permissions to read and send emails, access and modify files, and read and modify calendar information. The tokens could provide access to resources associated with the work account signed into Authenticator on the affected device.

However, Microsoft and researchers differ on whether user interaction is necessary. Enclave reported obtaining tokens without direct user interaction, while Microsoft states that exploitation requires the victim to complete an authentication flow.

Microsoft confirmed that the vulnerability has not been exploited in attacks and considers exploitation less likely.