A Flaw in Microsoft Authenticator for Android Let Rogue Apps Quietly Take Over Work Accounts
Researchers found that Microsoft Authenticator on Android handed out sign-in tokens to any app that claimed to be Teams or Outlook, with no prompt. Microsoft has fixed it in version 6.2606.4246. Here are the key questions answered and the layers that keep one phone from exposing a whole account.
Here Is How Layered Defenses Keep One Bad App on One Phone From Handing Over Your Whole Work Account
Most people think of an authenticator app as the thing that makes their account safer. On Android, Microsoft Authenticator also quietly does another job: it hands out sign-in passes to other Microsoft apps. Researchers found it was handing them to the wrong apps too.
We based this Pick on Help Net Security’s report on the research.
Questions and answers
What does Authenticator do besides show codes?
On Android it acts as a “broker.” When Teams, Outlook or another Microsoft app needs to sign in, it asks Authenticator, which returns a token, a digital pass proving the user is logged in. Because it controls access to the whole account, it is supposed to be strict about which apps get those tokens.
What went wrong?
Ofek Levin, a researcher in Enclave’s fellowship program, found that one part of Authenticator could be opened by any app on the phone and did not verify which app was really asking. It checked that the request details matched the genuine Teams app installed on the device, but any app can read those details. Authenticator knew the true caller and simply did not use that information. A malicious app could claim to be Teams and get Teams’ tokens.
What could an attacker do with those tokens?
With one work account signed into Authenticator, the researchers’ test app got tokens that could read and send email, read and change files, calendars and SharePoint sites, and send Teams messages as the user. By posing as Authenticator itself, it could also change the account’s sign-in methods, including adding and deleting passkeys. An attacker who adds their own passkey can keep getting in even after the malicious app is removed.
Would the user notice?
No. The malicious app needed no special permissions, and there was no prompt or warning. The one hurdle is that someone has to be tricked into installing the malicious app in the first place.
Is it fixed?
Yes. Enclave reported it to Microsoft, which released a fix tracked as CVE-2026-80097, published on September 8, 2026, and rated CVSS 8.6. Every Authenticator for Android version before 6.2606.4246 is affected.
Who should act, and how
- Every Android user with a work account: Update Microsoft Authenticator from the Google Play Store and confirm the version is 6.2606.4246 or later.
- IT administrators: Use your mobile device management (MDM) tool to report Authenticator versions and enforce that minimum on company and enrolled personal phones.
- Everyone: Avoid sideloading apps or installing unfamiliar ones from outside trusted stores.
The layers that limit the damage
Patching closes this particular hole. Layers make sure the next one does not become a full account takeover:
- Control what gets installed. Block sideloading on managed phones and use a work profile so business apps are kept apart from personal ones. Mobile threat defense tools are one example of a way to flag risky apps.
- Check device health at sign-in. Conditional access policies in your identity platform can require a managed, up-to-date device before granting access to email and files.
- Watch sign-in method changes. Alert on new passkeys, new authenticator registrations or other changes to how users sign in, and review them quickly.
- Shorten what a stolen token is worth. Use session controls and the ability to revoke sessions, so a suspected compromise can be cut off everywhere at once.
- Have a lost-phone and bad-app playbook. Know how to wipe the work profile, revoke sessions, remove unknown sign-in methods and reset credentials.
What this means for your company
Phones are now a key part of how employees sign in, so a weakness in one app on one phone can reach email, files and chat. Keep authenticator and other security apps updated, manage the phones that touch company data and watch for changes to sign-in methods, since that is how an attacker stays in. Microsoft is named here because the flaw was in its app, but the same layered approach applies whichever identity platform and authenticator your business uses.
Need help managing the phones that access your company data and tightening how your team signs in? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
