A high-severity security vulnerability in Microsoft Authenticator for Android could allow malicious apps installed on a device to steal authentication tokens and gain access to users’ work accounts.
Tracked as CVE-2026-80097, the vulnerability carries a CVSS score of 8.6 out of 10 and was disclosed in September 2026.
Security researchers found that the flaw could allow an unprivileged Android app to impersonate a trusted application when interacting with Microsoft Authenticator. By exploiting weaknesses in how the app verifies the identity of requesting applications, a malicious app could obtain authentication tokens associated with a user’s work account. These tokens could potentially provide access to sensitive information, including emails, files, calendars, and SharePoint resources.
The vulnerability affects Microsoft Authenticator for Android and was addressed in version 6.2606.4246, according to available vulnerability records. Users should update the app to the fixed version or a later release. Researchers reported that the flaw could be exploited by a malicious app already installed on the affected device, making it particularly concerning for organizations that rely on mobile devices to access Microsoft 365 services.
The security disclosure comes as another Microsoft 365 account-compromise campaign highlights the risks associated with stolen authentication tokens. Cybersecurity firm Huntress reported that attackers used adversary-in-the-middle phishing infrastructure to capture legitimate sign-in sessions and replay stolen tokens against Microsoft 365 accounts between July 14 and September 22, 2026.
Huntress recorded 497 successful sign-in events across 79 organizations during the campaign and identified 97 compromised accounts. The attackers also registered at least 48 unauthorized Microsoft Entra devices, modified victims’ multifactor authentication methods, and created email inbox rules to conceal malicious activity.
Instead of repeatedly guessing passwords, the attackers reused stolen session tokens to access accounts without going through the normal sign-in process again. In some cases, they altered security settings to maintain access and used compromised mailboxes to send potentially fraudulent business communications.
Although the Authenticator vulnerability and the token-replay campaign are separate security issues, both highlight the importance of protecting authentication sessions and account credentials. Multifactor authentication remains an important security measure, but stolen session tokens can allow attackers to bypass some of the protections users expect from an additional sign-in factor.
Microsoft Authenticator users should install the latest available update and ensure their Android devices are protected against untrusted applications. Organizations should also review Microsoft Entra sign-in logs for suspicious activity, revoke potentially compromised sessions, remove unauthorized devices, and reset affected users’ authentication methods where necessary.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Security teams should strengthen Conditional Access policies and consider requiring compliant or managed devices for access to sensitive company resources. Administrators should also review unexpected changes to multifactor authentication settings and investigate unusual sign-ins, particularly those originating from unfamiliar devices or locations.
