Microsoft Authenticator Flaw : Trusted to Protect, Exposed to Attack

What if the app you trust to protect your work account could be tricked into giving access to a malicious application on the same phone?

Multi-factor authentication (MFA) is designed to make unauthorised access harder. But what happens when the application responsible for helping verify your identity can be tricked into handing your access to the wrong app?

Microsoft has patched a high-severity vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097, that could allow a malicious application to obtain authentication tokens for a signed-in work account by impersonating a trusted Microsoft application, such as Teams.

The flaw, disclosed in a technical research, stems from improper authentication within Authenticator’s account-handling process. Researchers demonstrated that a malicious app could exploit this weakness to obtain tokens capable of accessing corporate email, files, calendars and other Microsoft 365 resources. Microsoft released a fix in September 2026.  

For organisations that rely on Microsoft 365, this is an important reminder that identity-based attacks do not always begin with a stolen password. Weaknesses in the applications that manage authentication can also create opportunities for account takeover.

What happened?

Microsoft Authenticator does more than generate verification codes. On Android, it also acts as an authentication broker, helping Microsoft applications such as Outlook and Teams obtain tokens that confirm a user's identity.

The vulnerability allowed a malicious application to impersonate a legitimate Microsoft application during the token request process. In testing, the researchers demonstrated that the resulting tokens could provide access to sensitive business resources without the malicious application needing special Android permissions.

In practical terms, these tokens could provide access to corporate email, files, calendars and other Microsoft 365 resources, depending on the permissions granted.

The attack requires a malicious application to be installed on the Android device. Microsoft's advisory also indicates that the victim must complete an authentication flow.  

What Is The Risk To Organisations?

Successful exploitation could have serious consequences for businesses, including:

• Business Email Compromise (BEC): Employee impersonation and payment fraud.

• Data exposure: Unauthorised access to Microsoft 365 emails and files.

• Account takeover: Attackers using stolen tokens to impersonate legitimate users.

• Persistent access: Unauthorised changes to authentication methods, including passkeys.

• Further attacks: Internal phishing and additional identity-based attacks.

These risks are relevant to organisations that rely on cloud collaboration platforms, digital financial services and mobile devices to conduct business.

Who is Affected?

Organisations and individuals using Microsoft Authenticator for Android versions earlier than 6.2606.4246 should prioritise updating the application.

The issue is particularly relevant to organisations where employees:

• Use Android devices to access Microsoft 365 work accounts.

• Install applications from untrusted sources or sideload APK files.

• Use personal devices for corporate access without adequate security controls.

• Have access to sensitive business information or privileged accounts.

Recommendations

• Update immediately: Upgrade Microsoft Authenticator for Android to version 6.2606.4246 or later.

• Enforce compliance: Ensure all managed Android devices run the patched version.

• Review sign-in logs: Investigate unusual logins, unfamiliar devices and suspicious Microsoft 365 access.

• Secure affected accounts: If compromise is suspected, revoke active sessions and review registered passkeys and other authentication methods.

• Prevent malicious apps: Restrict installations from untrusted sources and enforce mobile application security policies.

CVE-2026-80097 reinforces an important lesson for security teams. protecting identities requires more than securing passwords and enabling multi-factor authentication. Monitoring identity activity alongside endpoint and cloud telemetry can help organisations detect suspicious behaviour and investigate potential account compromise.