A researcher showed that on Android, another app on the phone could trick the Microsoft Authenticator app into handing over sign-in tokens for a work account (such as email and files). Microsoft has a fix. Update the app from the Play Store.
- Status
- Patched: update now
- Being attacked?
- Not known[2]
- Severity
- High
- Updated
No report that anyone has used this bug. Severity: NVD score 8.6 out of 10 (CVE-2026-80097) First reported .
Am I affected?
You may be at risk if you use Microsoft Authenticator on an Android phone with a work or school account and have not updated the app recently. iPhone is not mentioned in the sources.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Microsoft Authenticator (Android) | Android | Microsoft Authenticator for Android with an out-of-date app (exact versions not published in our sources) | Microsoft has patched the app. Update from Google Play. The exact fixed version is not confirmed.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
Microsoft Authenticator (Android) on Android
Easy way: On your Android phone: open Google Play > tap your picture > Manage apps and device > Updates available.
How to fix it
- Open the Google Play Store.
- Tap your picture > Manage apps and device > Updates available.
- Update Microsoft Authenticator.
- Remove apps you do not use or trust.
More on each app: Is my Microsoft Authenticator up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/microsoft-authenticator-android-token-bug.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-80097
Sources
- NVDNVD: CVE-2026-80097 (Sep 8, 2026)
- ResearcherEnclave AI: AuthMask, Microsoft Authenticator hands over tokens (Oct 23, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.