Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

A vulnerability in the Microsoft Authenticator app for Android allowed malicious apps without permissions to impersonate trusted Microsoft apps and collect work account sign-in tokens. Microsoft has addressed the issue, tracking it as CVE-2026-80097, and released a fix in version 6.2606.4246 of the Authenticator app for Android. Users of the app should update to this version to protect themselves. The flaw was demonstrated by researchers, who showed that a malicious app could pose as a trusted app, such as Teams, to steal tokens. The update is necessary to prevent permissionless Android apps from stealing work account tokens.