Microsoft Authenticator for Android CVE-2026-80097: a malicious app with no permissions could steal work-account (Entra ID) tokens. Which Authenticator version fixes it?

What it is: CVE-2026-80097 (CVSS 8.6) is a flaw in Microsoft Authenticator for Android, which also acts as the sign-in broker for work and school (Microsoft Entra ID) accounts on Android. Another app on the same phone, without requesting any special permissions, could obtain tokens for the signed-in work account and use them to authenticate as that user and reach their resources (mail, files, Teams and other Microsoft 365 data). Microsoft fixed it in the September 2026 updates; technical details were published on October 23, 2026. It was reported by a researcher through the Enclave fellowship program and was not known to be exploited. Am I affected: - Android devices with Microsoft Authenticator older than 6.2606.4246 and a work or school account added (including devices where Authenticator is only the broker for Outlook, Teams or Company Portal sign-ins). - Check: Authenticator, Settings (or the menu), About shows the version; or Google Play, Manage apps. Admins can see app versions in Intune or their MDM. Fix: 1. Update Microsoft Authenticator on Android to 6.2606.4246 or later from Google Play (turn on auto-update). 2. Organizations: enforce a minimum Authenticator version through Intune app protection or device compliance policies, and block access from devices below it. 3. Keep users from installing apps from unknown sources on phones that hold work accounts, since the attack needs a malicious app on the same device. After: if you suspect a device ran a malicious app, revoke the user's sessions and refresh tokens in Entra ID, remove and re-add the account in Authenticator after updating, and review sign-in logs for that user for unfamiliar activity. Sources: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097