Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
· thehackernews.com · popularity 21/100 · 0 similar stories today · Reference & How-To (Discovery & Research)
Read the original at thehackernews.com →
Summary
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,
Found in: The Hacker News. Rating basis: single outlet; outlet tier 2 (unlisted); 1 feeds; feed position 1.