Security · Updated 27 Oct, 05:39 pm IST
Microsoft fixes Android Authenticator flaw that exposed work account tokens
Why it matters for readers: It explains how a phone app that helps sign you in can be tricked and why keeping apps updated matters.
- The flaw let a malicious, permissionless Android app start an exposed Authenticator component and obtain tokens that grant access to email, files, and calendar.1
- Microsoft tracked the issue as CVE-2026-80097, rated 8.6 on the CVSS scale and assigned on September 8, 2026.1
- Microsoft fixed the vulnerability in Authenticator for Android version 6.2606.4246 and advises users to update.1
- Research was published by Ofek Levin through a fellowship at security firm Enclave on October 23, 2026.1
- Microsoft says exploitation additionally requires the user to complete a sign-in step in Authenticator and that there are no known attacks using the flaw.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started