A vulnerability existed in the Microsoft Authenticator application for Android.
This defect permitted an unauthorized application, one lacking any specific permissions, to impersonate a legitimate Microsoft application, like Teams. Such impersonation allowed the malicious app to gather sign-in tokens associated with a user's corporate account.
Microsoft has officially tracked this security issue under the identifier CVE-2026-80097.
The vendor has released a patch addressing this flaw in Authenticator for Android version 6.2606.4246.
Consequently, all users of the application are advised to perform an immediate update to the specified version.
The scope of the vulnerability was demonstrated during testing conducted by security researchers.
This incident highlights the ongoing challenges in application sandboxing and identity verification within mobile operating environments.
The resolution by Microsoft addresses a critical vector for token theft targeting enterprise credentials.
