Zero-Permission Android Bug Let Rogue Apps Hijack Microsoft Tokens

How an unprivileged app fooled Authenticator

The flaw stemmed from a failure to verify the digital identity of the application requesting account authentication.

Microsoft Authenticator acts as an authentication broker on Android devices. When official productivity apps like Outlook or Teams need access to a corporate account, Authenticator handles the token issuance under the hood so users do not have to type credentials repeatedly.

Security firm Enclave discovered that Authenticator never validated whether the calling application was actually the legitimate Microsoft program it claimed to be. In proof-of-concept tests, researchers installed a seemingly harmless third-party app with zero system permissions. The app sent a standard request to Authenticator asking for an access token, supplying the official bundle identifier, redirect URI, and client ID used by Microsoft Teams.

Authenticator took the metadata at face value. Because the client ID and package details matched legitimate services, Authenticator handed the session tokens straight to the fake app entirely in the background. The user saw no prompt, received no login alert, and never had to approve a consent screen.

Microsoft Authenticator Android vulnerability at a glance

Full account compromise without passwords

With valid session tokens in hand, malicious software gained extensive read and write access to Microsoft 365 environments.

Session tokens bypass password verification and multi-factor prompts because the identity provider treats them as an already authenticated session. With the stolen tokens, the researchers could read and send Teams chats, browse corporate email, download confidential files, alter calendars, and even register or delete account passkeys.

Standard mobile security advice tells users to look out for apps requesting fishy permissions, such as access to accessibility services, SMS logs, or contacts. This exploit turned that security model on its head because it worked without requesting a single Android runtime privilege.

While organizations frequently deploy controls like AI phishing detection shields to stop credential theft through deceptive links, client-side broker spoofing entirely sidelines those cloud-side protections.

Check your version number today

Updating the Authenticator app through the Google Play Store completely closes the attack vector.

Microsoft confirmed the vulnerability under identifier CVE-2026-80097 and rolled out an immediate update. All Android builds prior to version 6.2606.4246 remain vulnerable.

Enclave confirmed the exploit was developed and tested strictly within a controlled lab environment, meaning there were no signs of threat actors weaponizing the bug prior to disclosure. However, because rogue developers could attempt to recreate the technique, enterprise IT admins and individual users should ensure their devices run the patched release immediately.

Availability and rollout

The security update is live globally across the Google Play Store for US, UK, and European users. If your device has automatic app updates turned on, your phone may already be running version 6.2606.4246 or newer.

To verify manually, open Authenticator, tap the settings menu, scroll down to the version number, and trigger an update via Google Play if you are running an older build.