Summary
CVE-2026-80097 is a high-severity improper authentication vulnerability in Microsoft Authenticator for Android. It allows a malicious application to impersonate a trusted Microsoft app and obtain authentication tokens associated with a user’s signed-in work account. The underlying issue is that Authenticator does not properly verify the actual identity of the application requesting a token. Researchers demonstrated that these tokens could provide access to Microsoft Graph resources, including emails, files, and calendars. Microsoft addressed the vulnerability in version 6.2606.4246. Organizations should update affected installations to the fixed version and verify that the update reaches all Android devices.
Urgent Actions Required
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later across all affected devices.
- Check app versions on employee devices and use mobile device management (MDM) tools to verify that the security update has been installed.
- Restrict the installation of applications from untrusted sources and limit sideloading on managed Android devices.
- Review Microsoft Entra ID sign-in activity for unusual authentication events, unexpected token usage, and suspicious Microsoft Graph activity.
- Investigate unexpected passkey registrations, deletions, or other authentication method changes.
- Revoke sessions for potentially compromised accounts if there are indications that authentication tokens may have been stolen.
Which Systems Are Vulnerable to CVE-2026-80097?
Technical Overview
- Vulnerability Type: Improper Authentication (CWE-287), leading to local privilege escalation and authentication token theft.
- Affected Software/Versions: Microsoft Authenticator for Android 6.0.0 to versions earlier than 6.2606.4246.
- CVSS Vector: v3.1
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-80097 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-80097?
Vulnerability Root Cause:
CVE-2026-80097 occurs because Microsoft Authenticator does not properly verify which app is requesting authentication tokens. This lets a malicious Android app pretend to be a trusted app, such as Teams, and steal tokens from a signed-in work account.
How Can You Mitigate CVE-2026-80097?
If immediate patching is delayed or not possible:
- Restrict the installation of untrusted Android apps, including apps installed through sideloading.
- Use mobile device management (MDM) to identify devices running vulnerable Authenticator versions and track update status.
- Review Microsoft Entra sign-in activity and Microsoft Graph activity for unusual access to emails, files, and calendars.
- Check for unexpected refresh token use or changes to authentication methods and passkeys.
- Investigate suspicious activity and revoke affected user sessions if token misuse is suspected.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- Android Devices - Devices running Microsoft Authenticator versions 6.0.0 to earlier than 6.2606.4246
- Microsoft Work Accounts - Work accounts signed in to the vulnerable Authenticator app
- Business-Critical Systems at Risk:
- Email and Communication - Access to emails and Teams-related resources through stolen authentication tokens
- Business Files - Potential unauthorized access to files stored in Microsoft 365 services
- Calendars - Exposure of users' calendar information
- Authentication Settings - Researchers also demonstrated access to functions involving authentication methods and passkey management
- Exposure Level:
- Devices with Vulnerable Authenticator Versions - Android devices running versions earlier than 6.2606.4246
- Devices with Signed-In Work Accounts - The risk applies when a work account is already signed in to Microsoft Authenticator
- Devices with Malicious Apps - A malicious app installed on the device could exploit the issue by impersonating a trusted Microsoft application
How Can You Detect CVE-2026-80097 Exploitation?
Exploitation Signatures:
- Unexpected launches of Authenticator’s AccountChooserActivity by third-party Android apps
- Requests where the claimed Microsoft app identity does not match the actual requesting app
- Suspicious token requests involving apps impersonating trusted Microsoft applications, such as Teams
Indicators of Compromise (IOCs/IOAs):
- Unexpected authentication token requests from unrecognized Android apps
- Unusual use of Microsoft Graph resources, including email, files, and calendars
- Unexpected changes to authentication methods or passkey settings
Behavioral Indicators:
- Third-party apps attempting to access Authenticator's exported AccountChooserActivity
- Authentication tokens being issued following requests that claim to originate from trusted Microsoft apps
- Unusual refresh token activity or access to account resources
Alerting Strategy:
- Priority: High
- Alert on unexpected token activity involving unfamiliar mobile apps
- Investigate unusual Microsoft Graph access and authentication method changes
- Review suspicious refresh token usage and revoke affected sessions when token misuse is suspected
Remediation & Response
- Remediation Timeline:
- Immediate: Identify Android devices running vulnerable Microsoft Authenticator versions
- As soon as possible: Update Microsoft Authenticator to version 6.2606.4246 or later
- After updating: Verify update coverage through mobile device management (MDM)
- Incident Response Considerations:
- Review Microsoft Entra sign-in records and Microsoft Graph activity for unusual account access
- Check for suspicious refresh token usage and unexpected changes to authentication methods or passkeys
- Investigate potentially unauthorized access to emails, files, and calendars
- Revoke affected user sessions if token misuse is suspected
Strengthen Endpoint Security with Proactive Detection and Response
-
-
- Discover how to detect and respond to endpoint threats faster
- Explore real-time monitoring and automated threat response
- Learn how to investigate threats and isolate infected endpoints
- Reduce alert fatigue and gain better control over your endpoints
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 8.6 | High-severity vulnerability with significant potential impact |
| Attack Vector | Local | Exploitation requires access to the affected Android device |
| Attack Complexity | Low | No special conditions are required to carry out the attack |
| Privileges Required | None | The attacker does not need existing privileges on the device |
| User Interaction | Required | The CVSS assessment indicates that user interaction is needed |
| Scope | Changed | Exploitation can affect resources beyond the vulnerable application |
| Confidentiality Impact | High | Stolen tokens may expose sensitive work account information |
| Integrity Impact | High | Unauthorized access may allow changes to account resources |
| Availability Impact | High | The CVSS assessment assigns a high impact to availability |
References:
