Overview
- Researchers at Enclave reported a vulnerability that let any app on an Android device start an exported activity in Microsoft Authenticator and request tokens while supplying its own app identity.
- Enclave’s tests showed a malicious app could obtain Microsoft Graph tokens that allowed reading and sending email, accessing and changing files and calendars, sending Teams messages, and altering sign‑in methods such as passkeys.
- Microsoft assigned the issue CVE‑2026‑80097, rated it 8.6, and released a patched Authenticator for Android (version 6.2606.4246) on September 8 as the official fix.
- Microsoft and Enclave disagree about whether the attack needs further user interaction; Enclave says its proof‑of‑concept required no prompts beyond a signed‑in account while Microsoft says the attacker must complete an Authenticator sign‑in flow.
- Administrators should enforce the minimum patched Authenticator version through device management, block sideloading and untrusted apps, and assume high impact until organizations confirm whether updating revokes any tokens already issued to a malicious app.