A critical security flaw has been identified and patched in **Microsoft Authenticator** for Android, posing a risk to enterprise users. The vulnerability, designated as **CVE-2026-80097**, enabled unprivileged malicious apps to masquerade as trusted **Microsoft** applications and pilfer sign-in tokens from work accounts. ### The Impersonation Mechanism The **Microsoft Authenticator** app on Android serves as more than just a multi-factor authentication (MFA) code generator; it also acts as a crucial token broker for other **Microsoft** applications such as **Teams** and **Outlook**. When these applications require user authentication, they request a token from **Authenticator**, which then issues a digital pass proving the user's logged-in status. Security researchers at **Enclave**, specifically **Ofek Levin** through a fellowship program, discovered that **Authenticator** exposed a component, `AccountChooserActivity`, accessible by any app on the device. A malicious app could initiate this activity and supply its own values for constructing a token request, including the name of the app it claimed to be. By asserting it was **Teams**, the **Authenticator** broker, alarmingly, believed the false identity. ### Bypassing Signature Checks A signature verification mechanism was intended to prevent such impersonation. However, the check would look up the legitimate signature of the spoofed app (e.g., **Teams**) on the device and confirm the request matched it. Since **Teams** was genuinely installed, its true signature was present, allowing the check to pass despite the request originating from a malicious source. **Enclave** noted that while **Authenticator** could identify the actual requesting app, it failed to use this information to deny token issuance. ### Potential Impact and Discrepancies **Enclave**'s proof-of-concept demonstrated that impersonating **Teams** and requesting **Microsoft Graph** tokens could yield extensive permissions, including the ability to read and send mail, read and write files, and manage calendars. **Microsoft** broadly describes the outcome as an attacker successfully authenticating as the signed-in user to access their resources, with tokens applying specifically to the work account configured in **Authenticator** on that device. There is a notable discrepancy between **Enclave**'s findings and **Microsoft**'s advisory regarding user interaction. **Enclave** reported that their proof-of-concept obtained tokens without any user interaction beyond an existing signed-in account. In contrast, **Microsoft**'s advisory states that exploitation requires installing a malicious app and convincing the user to complete an authentication flow within **Authenticator**, a requirement also reflected in its CVSS score of 8.6 (rated as "Important"). ### The Fix and Recommendations **Microsoft** addressed **CVE-2026-80097** as part of its September 2026 Patch Tuesday. The company asserts that the flaw has not been exploited in the wild and was not publicly disclosed prior to the fix, rating exploitation as "less likely." It is not currently listed in the U.S. CISA Known Exploited Vulnerabilities catalog. To mitigate this risk, users of **Microsoft Authenticator** for Android must update to version **6.2606.4246** or later. Organizations managing Android devices can enforce this minimum version through their device management solutions. While the fix is available, it remains unclear whether updating the app invalidates any tokens potentially obtained by a malicious application before the update.