Microsoft Authenticator is the app many businesses rely on to protect Microsoft 365 logins. We recommended it in our tip on Microsoft retiring text message sign-in. Researchers have now shown that older versions on Android could be tricked into handing out access to a work account. A fix is available, and updating takes about a minute.
What Happened
Researchers at Enclave found a flaw, tracked as CVE-2026-80097 and rated 8.6 out of 10, in Authenticator for Android. Besides showing sign-in codes, the app acts as a middleman for other Microsoft apps like Teams and Outlook. When one of them needs you signed in, Authenticator hands over a token, which is a digital pass that proves you are logged in.
The flaw was that Authenticator did not properly check which app was asking. A malicious app with no special permissions could claim to be Teams, and Authenticator believed it.
What Was at Risk
In testing, the stolen tokens gave access to the work account’s email, files, and calendar. This applies to the work account signed into Authenticator on that phone.
How Serious Is It?
Microsoft says an attacker needs a malicious app installed on the phone and the user must complete a sign-in step in Authenticator. Microsoft also says the flaw has not been used in attacks. The researchers reported that their test needed no action beyond having an account signed in. Either way, the fix is available. Microsoft has not said whether updating cancels tokens a malicious app may already have collected.
Why This Matters for Your Business
Many employees use personal or shared Android phones for work email and Teams. That is especially common for field crews, warehouse staff, and drivers. One bad app on that phone can be enough.
What Your Team Should Do Right Now
- Update Microsoft Authenticator on every Android phone. Open Google Play, search for Microsoft Authenticator, and tap Update. Version 6.2606.4246 or newer includes the fix.
- If you manage phones, require that minimum version through your device management tool.
- Install apps only from Google Play, and remove apps nobody uses on phones that access work accounts.
- Never approve an Authenticator sign-in prompt you did not start.
- If a phone may have had a suspicious app, ask IT to review recent sign-ins and end active sessions.
The Bottom Line
Authenticator is still one of the best ways to protect work accounts, and far stronger than text message codes. It only protects you when it is up to date. Check your Android phones today.