// Microsoft 365HIGH
CVE-2026-80097, a high-severity elevation-of-privilege vulnerability in Microsoft Authenticator for Android (CVSS 8.6), allows malicious applications without any Android permissions to impersonate trusted Microsoft apps and steal authentication tokens. The flaw stems from improper validation in the exported AccountChooserActivity, enabling attackers to extract access tokens, refresh tokens, and ID tokens that can be reused to gain unauthorized access to Microsoft 365 resources including Teams, SharePoint, OneDrive, and Exchange. Microsoft released a fix in version 6.2606.4246.
- Microsoft Authenticator Flaw Allows Android Apps With Zero Permi(opens in a new tab)
- Microsoft Authenticator vulnerability let rogue Android apps ste(opens in a new tab)
- Microsoft Authenticator flaw: Enclave’s findings | NeoTeo(opens in a new tab)
// Get alerts for Microsoft 365