A Trusted App Becomes an Attack Surface

Microsoft Authenticator is one of the most widely deployed tools in enterprise mobile security. It brokers sign-ins, approves push notifications, and stores tokens for work accounts on millions of Android devices. That trust is precisely what made a newly disclosed vulnerability so concerning: a malicious app installed on the same phone could abuse Authenticator itself to walk away with work account access tokens, without requesting a single Android permission.

Microsoft has patched the issue, tracked as CVE-2026-80097, which carries a high-severity CVSS score of 8.6. The company classified it as a local elevation-of-privilege vulnerability.

What the Flaw Allowed

According to reporting from Cyber Security News, the weakness stemmed from improper authentication in the broker component of Microsoft Authenticator for Android. The broker is the part of the app responsible for handling authentication requests from other applications and services on the device.

Because that component did not adequately verify who was making a request, a malicious app with no declared permissions could interact with it and obtain access tokens tied to a signed-in work account. In practical terms, an attacker would not need to trick the user into granting dangerous permissions such as reading storage or accessing accounts. Simply having a hostile app installed on the same device was enough.

The conditions for exploitation were straightforward:

  • An Android device with Microsoft Authenticator installed.
  • A work account signed in to the app.
  • A malicious application present on the device capable of reaching the vulnerable broker interface.

That combination is common in bring-your-own-device and corporate-managed fleets alike, which is why the severity rating reflects real-world risk rather than a theoretical edge case.

Why Token Theft Matters More Than Password Theft

Access tokens are the currency of modern identity. Once an attacker holds a valid token, they can often reach Microsoft 365 services, email, files, and other connected resources without knowing the victim's password or triggering a fresh sign-in prompt. Multi-factor authentication, the control that Authenticator itself helps enforce, does not necessarily stop a stolen token from being replayed.

This is what elevates the finding beyond a routine local privilege escalation. A zero-permission attack path that yields work account tokens effectively bypasses the layered defenses many organizations rely on: MFA prompts, conditional access policies that trust the device, and the assumption that a managed phone is a safe place to store credentials.

Microsoft's Response

Microsoft addressed the vulnerability in an update to Authenticator for Android and characterized it as a local elevation-of-privilege issue. The company did not indicate that the flaw was exploited in the wild, and the patch closes the improper authentication gap in the broker component.

Organizations should treat the fix as mandatory rather than optional. Because the vulnerability lives in an app that users install and update themselves, patch coverage depends heavily on how quickly the workforce applies updates.

Recommended Actions for Defenders

Security teams can reduce exposure with a few concrete steps:

  1. Verify Authenticator versions. Confirm that managed devices are running a build that includes the fix, and use mobile device management to push updates where possible.
  2. Inventory sideloaded apps. Malicious apps distributed outside official stores are a primary delivery route for this class of attack. Restrict or monitor sideloading on corporate devices.
  3. Harden token protections. Review conditional access policies, token lifetime settings, and device compliance requirements so that a stolen token has a shorter useful life and narrower reach.
  4. Monitor for anomalous sign-ins. Alert on token use from unfamiliar locations, unusual user agents, or atypical access patterns that could indicate replay.
  5. Reassess BYOD assumptions. If personal devices hold work identities, ensure they meet baseline security requirements before granting access to sensitive resources.

The Bigger Lesson

This disclosure is a reminder that authenticator apps are not neutral utilities sitting outside the threat model. They hold high-value material, and their inter-process interfaces are attack surface. A flaw that requires no permissions from the attacker flips the usual mobile security equation, where users are trained to scrutinize permission requests. There is nothing to scrutinize when the malicious app asks for nothing at all.

For enterprises, the takeaway is to treat identity apps with the same patch urgency and monitoring rigor applied to browsers and VPN clients, and to assume that tokens, not just passwords, are targets worth defending.

Original source: Cyber Security News — Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions