CVE-2026-80097: Microsoft Authenticator flaw allowed permissionless Android apps to steal work tokens

# CVE-2026-80097: Microsoft Authenticator flaw allowed permissionless Android apps to steal work tokens

https://gcdradar.vercel.app/incidents/cve-2026-80097-microsoft-authenticator-flaw-allowed-permissi · AIR-2026-1572 · closed 2026-11-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with researcher finding and a fix available.
- Fix status: Patched
- First reported: 2026-10-27
- AI role: No AI role
- Products: Microsoft Authenticator
- CVE ids: CVE-2026-80097

## Summary

Researchers discovered a vulnerability in Microsoft Authenticator for Android that allowed unauthorized applications on the device to quietly hijack work account tokens without requiring special permissions or user interaction. Microsoft has released an update to resolve the security issue.

## What to do

Update Microsoft Authenticator on Android to the latest patched version.

## Affected and fixed versions

- Affected: Microsoft Authenticator for Android
- Fixed in: Latest version

## Latest updates

- 2026-10-27: Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens (https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html)
- 2026-10-27: Microsoft Authenticator vulnerability let rogue Android apps steal work account access (https://helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097)

## Sources

- 2026-10-27 Help Net Security: Microsoft Authenticator vulnerability let rogue Android apps steal work account access https://helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097
- 2026-10-27 The Hacker News: Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.