Microsoft Authenticator vulnerability let rogue Android apps steal work account access

A vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated CVSS 8.6, let any app on a phone impersonate apps such as Teams or Outlook and silently obtain tokens for the victim’s work account, researchers at Enclave found. The tokens could be used to read and send email, access files and SharePoint, send Teams messages and even add new passkeys; Microsoft has fixed the flaw, and users should update to Authenticator version 6.2606.4246 or later.