Cybersecurity researchers have uncovered a serious vulnerability in the Android version of Microsoft Authenticator that allowed unprivileged apps with zero special permissions to harvest authentication tokens for user work accounts.
Tracked as CVE-2026-80097, the flaw exposed sensitive enterprise data, including emails, calendars, and files, without requiring any interaction from the victim beyond having a signed-in work account on the device.
According to the researcher Ofek Levin’s findings, the root cause stemmed from a specific exported activity within the Microsoft Authenticator app named AccountChooserActivity. Because the activity was marked as exported, any third-party app installed on the same device could launch it and pass custom intent extras.
When testing the mechanism, the research team found that the application accepted nearly all incoming parameters straight from the calling app. While the code did perform validation to check if the requested redirect URI matched the signature of a legitimate installed app, such as Microsoft Teams, it completely failed to verify whether the actual application making the request matched the identity being claimed.
By spoofing the caller ID and mimicking a trusted first-party Microsoft application, an unprivileged app could trick the Authenticator broker into returning valid access tokens, refresh tokens, and ID tokens in plaintext.
In practical simulations, researchers successfully impersonated apps like Microsoft Teams to obtain high-privilege scopes, gaining full delegated access to user mailboxes, chat systems, files, and calendars. Although Microsoft Authenticator was already aware of the true package name of the calling app through Android functions, that real identity was only used for background bookkeeping rather than core security trust decisions.
Following responsible disclosure, the Microsoft Security Response Center confirmed the issue and issued a security patch. The vulnerability affects Android versions of Microsoft Authenticator prior to version 6.2606.4246.
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
