high

Microsoft Authenticator for Android flaw (CVE-2026-80097) lets zero-permission apps steal work-account tokens

2 fonte(s) · 2 atualização(ões) · publicado 26/10/2026 04:13 · coletado há 5 dias

A high-severity flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 (CVSS 8.6, "Important", CWE-287), lets a malicious app with no Android permissions impersonate trusted Microsoft apps and steal authentication tokens for the victim's signed-in work account. Researcher Ofek Levin, working through a fellowship at Enclave, found that versions earlier than 6.2606.4246 are affected, and Enclave published technical details on October 23, 2026 (thehackernews.com). Microsoft confirmed the report, assigned the CVE on September 8, 2026 and shipped the fix with the September 2026 Patch Tuesday. Microsoft says the flaw was not exploited or publicly disclosed before the fix and rates exploitation as "less likely"; it was not in the CISA KEV catalog as of October 26, 2026 (thehackernews.com).

Entenda a falha

A vulnerabilidade

CVE-2026-80097 (CVSS 8.6, "Important", CWE-287 Improper Authentication, classed by Microsoft as elevation of privilege) affects Microsoft Authenticator for Android in versions earlier than 6.2606.4246. A malicious app installed on the device, with no Android permissions, can pose as a trusted Microsoft app such as Teams and collect authentication tokens for the work account signed into Authenticator. The tokens cover only that account. Microsoft says exploitation requires the user to complete an authentication flow in Authenticator, while Enclave says its PoC needed only a signed-in account. The fix is version 6.2606.4246 or later.

Como funciona

Authenticator acts as a broker: Teams, Outlook and other Microsoft apps ask it for a sign-in token. Another app on the device can start the exported activity AccountChooserActivity and make the same request. Authenticator builds the token request from values the caller supplies: claimed package name, client ID, redirect URI, scopes and UID. It checks the redirect URI against the signature-derived URI of the claimed package, and the check passes because the real app is installed. It then returns the broker response through the activity result, which can hold access, refresh and ID tokens and client information in plaintext.

Por que é vulnerável

The broker trusted identity claims made by the caller. The redirect-URI check only validated the signature-derived URI for the claimed package and never confirmed that the real calling app was that package, so the check could be satisfied using the legitimate app's installed signature. Authenticator could identify the true caller through Android's getCallingActivity() but did not use it in its security decisions. The articles do not detail the fix beyond the patched version.

Onde está

The exported activity com.microsoft.identity.client.AccountChooserActivity in Microsoft Authenticator for Android, together with the broker's redirect-URI validation; no commit is named.

Como foi descoberta

Researcher Ofek Levin, working through a fellowship program at Enclave, found the flaw. Microsoft confirmed the report, assigned the CVE and published the advisory on September 8, 2026, with the fix in the September 2026 Patch Tuesday. Enclave published technical details on October 23, 2026. Microsoft says the flaw was not exploited or publicly disclosed before the fix and rates exploitation "less likely"; it was not in the CISA KEV catalog as of October 26. The articles do not say when the report was made or whether the weakness had been seen before. It is also unclear whether updating revokes tokens already obtained.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 10:16.

Detalhes técnicos

The root cause is an exported activity, com.microsoft.identity.client.AccountChooserActivity, which any other app on the device can launch to request tokens through Authenticator's broker service.
The broker trusted identity details supplied by the caller: claimed package name, client ID, redirect URI, scopes and caller UID.
The redirect-URI check only validated the signature-derived URI for the claimed package. It did not confirm that the real calling app matched that package. An attacker could therefore build the expected redirect URI from the legitimate app's installed signature, for example for Microsoft Teams, and pass validation. Because Teams must be genuinely installed for its signature to be readable, the check passed (thehackernews.com).
Authenticator could identify the true caller via Android's getCallingActivity() but did not use it in its security decisions.
The broker response returned through the activity result could contain access, refresh and ID tokens plus client information in plaintext.
In testing, impersonating Teams against Microsoft Graph produced delegated permissions covering mailbox, calendar, files, SharePoint and chat actions, including reading and sending mail and reading and writing files and calendars. Token issuance also worked when impersonating a Teams backend client and Authenticator's own client identity, each with different scopes.
The tokens apply only to the work account signed into Authenticator on that device, not to other accounts (thehackernews.com).

Remediação

Update Microsoft Authenticator on Android to version 6.2606.4246 or later and verify this on managed devices.
Organizations that manage Android devices can enforce this minimum version through device management (thehackernews.com).
Monitor managed Android devices for unexpected token use, suspicious Microsoft Graph activity and unauthorized application behavior.
Microsoft's advisory does not say whether updating cancels tokens a malicious app may already have obtained, so this remains unclear (thehackernews.com).

Relatos divergentes

User interaction: Enclave reported that its proof of concept returned tokens without any user interaction other than a signed-in account. Microsoft's advisory says exploitation requires installing a malicious app and convincing the user to complete an authentication flow in Authenticator, and its CVSS score reflects required user interaction (thehackernews.com). Microsoft's advisory is the authoritative source for severity scoring; Enclave's test is the more recent technical account, published October 23, 2026.

Linha do tempo

thehackernews.com ↗ · pub. 27/10/2026 09:09 · coletado 27/10 10:00

Microsoft fixes Authenticator for Android flaw (CVE-2026-80097) letting permissionless apps steal work account tokens

Adds Microsoft's position: no exploitation, not publicly disclosed before the fix and rated "less likely" to be exploited, with the flaw fixed in the September 2026 Patch Tuesday and absent from CISA KEV as of October 26. It also reveals a disagreement over whether user interaction is required, names researcher Ofek Levin and gives Enclave's October 23 publication date. Finally, it notes that MDM can enforce the minimum version and that token revocation after the update is unclear.
ler a análise desta fonte ocultar
Adds Microsoft's position: no exploitation, not publicly disclosed before the fix and rated "less likely" to be exploited, with the flaw fixed in the September 2026 Patch Tuesday and absent from CISA KEV as of October 26. It also reveals a disagreement over whether user interaction is required, names researcher Ofek Levin and gives Enclave's October 23 publication date. Finally, it notes that MDM can enforce the minimum version and that token revocation after the update is unclear.

Microsoft fixed CVE-2026-80097 (CVSS 8.6, "Important") in Microsoft Authenticator for Android, where a malicious app with no permissions could pose as a trusted Microsoft app such as Teams and collect sign-in tokens for the victim's work account. Enclave researcher Ofek Levin published the technical details on October 23, 2026. In tests the tokens gave full access to email, files and calendar. Microsoft says the flaw was not exploited or publicly disclosed before the fix and rates exploitation as "less likely". It is not in the CISA KEV catalog as of October 26, 2026.

Technical Details
- Authenticator acts as a token broker for Microsoft apps on Android. It exposes an activity, AccountChooserActivity, that any app on the device can start.
- The broker built its token request from caller-supplied values, including the claimed app name. A signature check compared the request against the real signature of the impersonated app. Because Teams was genuinely installed, its real signature was readable and the check passed.
- Authenticator could see which app actually made the request but did not use this in its decision.
- Impersonating Teams and requesting Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars. The tokens apply only to the work account signed into Authenticator on that device.
- The fix is in version 6.2606.4246. The CVE was assigned on September 8 and shipped with the September 2026 Patch Tuesday.
- Enclave and Microsoft disagree on user interaction. Enclave reports its proof of concept returned tokens with no interaction beyond a signed-in account. Microsoft's advisory and CVSS vector say the victim must install the malicious app and complete an authentication flow in Authenticator.
Remediation
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- Organizations can enforce this minimum version through mobile device management.
- It is unclear whether updating revokes tokens a malicious app may already have obtained, so consider reviewing token and sign-in activity for affected accounts.
gbhackers.com ↗ · pub. 26/10/2026 04:13 · coletado 26/10 05:00 primeiro registro

Microsoft Authenticator for Android flaw (CVE-2026-80097) lets zero-permission apps steal work-account tokens
ler a análise desta fonte ocultar
A high-severity flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 (CVSS 8.6, CWE-287), lets a malicious app with no Android permissions impersonate trusted Microsoft apps and steal authentication tokens for the victim's signed-in work account. Researchers at Enclave found that versions earlier than 6.2606.4246 are affected. Microsoft confirmed the report, released a fix and published the advisory on September 8, 2026. The article does not report exploitation in the wild.

Technical Details
- The root cause is an exported activity, com.microsoft.identity.client.AccountChooserActivity, which any other app on the device can launch to request tokens through Authenticator's broker service.
- The broker trusted identity details supplied by the caller: claimed package name, client ID, redirect URI, scopes and caller UID.
- The redirect-URI check only validated the signature-derived URI for the claimed package. It did not confirm that the real calling app matched that package. An attacker could therefore build the expected redirect URI from the legitimate app's installed signature, for example for Microsoft Teams, and pass validation.
- Authenticator could identify the true caller via Android's getCallingActivity() but did not use it in its security decisions.
- The broker response returned through the activity result could contain access, refresh and ID tokens plus client information in plaintext.
- In testing, impersonating Teams against Microsoft Graph produced delegated permissions covering mailbox, calendar, files, SharePoint and chat actions. Token issuance also worked when impersonating a Teams backend client and Authenticator's own client identity, each with different scopes.
Remediation
- Update Microsoft Authenticator on Android to version 6.2606.4246 or later and verify this on managed devices.
- Monitor managed Android devices for unexpected token use, suspicious Microsoft Graph activity and unauthorized application behavior.