CVE-2026-80097 in Microsoft Authenticator for Android allows malicious apps without permissions to steal authentication tokens by impersonating Microsoft applications and bypassing token broker security checks. Affected versions prior to 6.2606.4246 are vulnerable; tokens can grant unauthorized access to Microsoft Graph, Exchange, SharePoint, and Teams resources. A patch was released and published September 8, 2026.
- Microsoft Authenticator Flaw Allows Android Apps With Zero Permi(opens in a new tab)
- Microsoft patches high severity flaw in Authenticator for Androi(opens in a new tab)
- "Microsoft Authenticator for Android Flaw Exploited by Rogue App(opens in a new tab)
- Microsoft Authenticator vulnerability let rogue Android apps ste(opens in a new tab)
- Microsoft Authenticator Flaw Scores 8.6: Android Users Must Upda(opens in a new tab)
// Get alerts for Microsoft Azure