Microsoft has patched a high-severity vulnerability in Microsoft Authenticator for Android (CVE-2026-80097, CVSS 8.6) that could allow a local, unprivileged app to obtain delegated tokens for a user’s work account. The issue was caused by improper authentication in Authenticator’s broker component and affected Android devices with Authenticator installed and a signed-in work account.

How the flaw worked

Researchers at Enclave found that an untrusted app with no declared Android permissions could impersonate a trusted Microsoft client—such as Microsoft Teams—and request delegated tokens from Authenticator for that identity. The exploit required only that the malicious app be installed on the device; it did not require user approval or account credentials.

At the center of the issue was an exported activity in Authenticator called com.microsoft.identity.client.AccountChooserActivity. Other apps can launch exported activities, and in this case the activity accepted a broker request from the calling app and returned the authentication result in the activity result bundle.

The broker request contained several app-controlled fields: the claimed app package name, client ID, redirect URI, requested scopes, and even a caller UID value. Authenticator attempted a signature-related validation of the redirect URI, but that check validated the app identity as claimed inside the request rather than verifying the actual calling application.

An attacker could claim the identity of a legitimately installed Microsoft app. Because the validation used the claimed package identity to construct and verify the redirect URI, a malicious app could supply a matching redirect URI derived from the public package signature of the real app and pass the check. In short, Authenticator checked whether the claimed identity looked valid, but it did not confirm that the true caller was the app it claimed to be. Although the activity could determine the package that had launched it, that information was not used to enforce trust.

Impact

Successful requests returned token data in the activity result bundle. Returned credentials could include access tokens, refresh tokens, ID tokens, and client information. Depending on which Microsoft client identity was impersonated and which scopes were requested, an attacker could obtain delegated access to Microsoft Graph resources such as mailboxes, calendars, OneDrive files, SharePoint content, and Teams services.

Enclave’s proof-of-concept demonstrations included impersonating multiple Microsoft apps. For example, a forged Teams identity that requested Microsoft Graph permissions could receive delegated rights enabling reading and sending mail, accessing files, and modifying calendars—actions that pose significant risk for organizations that use Android devices to access Microsoft 365 resources.

Microsoft response and remediation

Microsoft classified the issue as an improper authentication vulnerability that could allow a local elevation of privilege. The company fixed the flaw in Microsoft Authenticator for Android version 6.2606.4246, released in July 2026. Administrators and users should update the app via Google Play immediately and ensure managed devices receive the patched release.

Recommendations

• Update Microsoft Authenticator for Android to version 6.2606.4246 (or later) through Google Play.
• Enforce timely app updates on managed devices using MDM/EMM solutions and restrict sideloading where possible.
• Review mobile application controls and restrict untrusted apps on devices that access corporate identities.
• Monitor Microsoft Graph for unusual activity, unexpected consent events, and token use from unfamiliar Android devices.
• Follow Microsoft’s official CVE-2026-80097 advisory for ongoing remediation guidance.

The flaw underscores that mobile identity brokers must validate the actual calling application—verifying package identity, UID, and signing certificate—rather than trusting app-controlled values supplied in intents. It also highlights Microsoft’s continued focus on protecting Entra credentials on rooted Android and jailbroken iOS devices, where weakened device controls and malware increase enterprise identity risk.