Microsoft Authenticator Flaw Let Rogue Apps Grab Work Tokens

Researchers at Enclave reported that a Microsoft Authenticator for Android flaw could let malicious apps obtain work-account tokens. Microsoft issued a fix in version 6.2606.4246, and the reports recommend updating.

• The reports identify the flaw as CVE-2026-80097 and say affected versions were earlier than 6.2606.4246.· 2 sources
• Enclave said an app could pose as an installed Microsoft app and obtain work-account tokens; Microsoft’s advisory and the researchers differed on whether user interaction was required.· 1 source
• Microsoft released the fix on September 8, 2026; the reports advise Android users to update to version 6.2606.4246 or later.· 2 sources