CVE-2026-80097

Name of the Vulnerable Software and Affected Versions Microsoft Authenticator for Android versions prior to 6.2606.4246

Description Improper authentication in the broker component of Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. On Android devices, this flaw enables malicious applications with no declared permissions to impersonate trusted clients and steal work account access tokens without user approval. This could lead to unauthorized access to corporate resources, including emails, Microsoft Teams chats, SharePoint documents, OneDrive files, and calendars.

Recommendations Update Microsoft Authenticator for Android to version 6.2606.4246 or newer.