{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "microsoft-authenticator-android-token-bug",
  "url": "https://patchgap.ai/incidents/microsoft-authenticator-android-token-bug/",
  "path": "/incidents/microsoft-authenticator-android-token-bug/",
  "json_url": "https://patchgap.ai/incidents/microsoft-authenticator-android-token-bug.json",
  "title": "Microsoft Authenticator on Android: update the app. A bug could let another app get work-account sign-ins.",
  "category": "phones",
  "platforms": [
   "android"
  ],
  "products": [
   "microsoft-authenticator"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "NVD score 8.6 out of 10 (CVE-2026-80097)",
  "exploited_in_wild": "unknown",
  "exploited_note": "No report that anyone has used this bug.",
  "exploited_source_url": "https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens",
  "confidence": "unconfirmed",
  "confidence_note": "The fixed app version is not listed in the sources we could read. Researchers say Microsoft has patched it.",
  "first_reported": "2026-09-08",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-80097"
  ],
  "summary": "A researcher showed that on Android, another app on the phone could trick the Microsoft Authenticator app into handing over sign-in tokens for a work account (such as email and files). Microsoft has a fix. Update the app from the Play Store.",
  "am_i_affected": "You may be at risk if you use Microsoft Authenticator on an Android phone with a work or school account and have not updated the app recently. iPhone is not mentioned in the sources.",
  "action": "Update Microsoft Authenticator (Android)",
  "affected": [
   {
    "product": "microsoft-authenticator",
    "product_name": "Microsoft Authenticator (Android)",
    "platform": "android",
    "affected_versions": "Microsoft Authenticator for Android with an out-of-date app (exact versions not published in our sources)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Microsoft has patched the app. Update from Google Play. The exact fixed version is not confirmed.",
    "fixed_source_urls": [
     "https://nvd.nist.gov/vuln/detail/CVE-2026-80097"
    ],
    "check": {
     "menu_path": "On your Android phone: open Google Play > tap your picture > Manage apps and device > Updates available.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://play.google.com/store/apps/details?id=com.azure.authenticator"
   }
  ],
  "fix_steps": [
   "Open the Google Play Store.",
   "Tap your picture > Manage apps and device > Updates available.",
   "Update Microsoft Authenticator.",
   "Remove apps you do not use or trust."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft Authenticator on Google Play",
    "url": "https://play.google.com/store/apps/details?id=com.azure.authenticator"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80097",
    "title": "NVD: CVE-2026-80097",
    "date": "2026-09-08",
    "kind": "nvd",
    "official": true
   },
   {
    "url": "https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens",
    "title": "Enclave AI: AuthMask, Microsoft Authenticator hands over tokens",
    "date": "2026-10-23",
    "kind": "research",
    "official": false
   }
  ]
 }
}