Microsoft patched CVE-2026-80097 in Android Authenticator version 6.2606.4246, resolving a vulnerability where an exposed AccountChooserActivity component allowed unprivileged apps to spoof trusted services like Teams and harvest account tokens.
The issue was discovered by researcher Ofek Levin through the Enclave grant program. Microsoft has officially documented the issue and classified it as a major severity. According to the researchers' tests, the digital keys that could be obtained gave full access to the account's emails, files, and calendar.
How was the deception done?
On Android devices, the Authenticator app helps sign in to Microsoft services. When an app like Teams requests a login, the Authenticator verifies that the user is signed in.
The Authenticator had a component that could launch any application on the device. When the malicious application activated it, the Authenticator would create an access request based on the credentials provided by the attacker, mistakenly believing it was Teams. The scan failed to stop this process because Teams was indeed installed on the device.
The difference in testing and attacking
There is a difference between what the researchers reported and Microsoft's official position on the process.
READ ALSO
Critical PHP vulnerabilities are already being exploited in attacks, according to CISA
Enclave said that in its own testing it was able to obtain digital keys without any user action beyond having a signed-in account. In contrast, Microsoft says that such an action requires both the installation of the malicious app and the user completing a sign-in step within Authenticator.
What about security and the solution?
Microsoft confirms that the issue has not been used in real attacks and was not publicly disclosed before being fixed.
The solution is included in the update to the Microsoft Authenticator app for Android to version 6.2606.4246, which was released through the official app store.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)