Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
At a glance
- Severity
- HighCVSS 8.6
- Used in attacks
- Not on CISA’s list
- Flaws named
- CVE-2026-80097
- Reported by
- 1 outlet
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,…
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Vulnerabilities referenced
- CVE-2026-800978.6High
Microsoft Authenticator
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Patch or advisory available
Full record →
Fastnexa security experts
Dealing with this in your own company?
If this story touches software, suppliers or systems you use, a Fastnexa security expert can tell you what it means for you and what to do first.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-27 12:09 UTC
Related stories
- Tailscale warns of SSH flaws allowing root privilege escalation
BleepingComputer · 2026-10-27
- Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Infosecurity Magazine · 2026-10-27
- Apple backports CoreGraphics zero-day patches to older iPhones
BleepingComputer · 2026-10-27
- Watchdog Urges Police and Fire Service to Improve Cybersecurity
Infosecurity Magazine · 2026-10-27
- OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
The Hacker News · 2026-10-27