🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator. ⠀ Researchers demonstrated that the stolen tokens could provide access to: • Email and the ability to send messages • Files stored in Microsoft services • Calendars and Teams chats • Authentication methods and passkey management ⠀ The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request. ⠀ Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in. ⠀ Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246. Users should update to version 6.2606.4246 or later.