Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

October 27, 2026 · 12:09 pm 1 sources

Image: The Hacker News

Coverage

More coverage

• Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
  The Hacker News · October 27, 2026 12:09
  Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android…