{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "microsoft-authenticator",
  "name": "Microsoft Authenticator (Android)",
  "short_name": "Microsoft Authenticator",
  "page_url": "https://patchgap.ai/is-my-microsoft-authenticator-up-to-date/",
  "minimum_safe_version": null,
  "minimum_safe_version_source": [
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80097",
    "title": "NVD: CVE-2026-80097",
    "date": "2026-09-08",
    "kind": "nvd"
   }
  ],
  "baseline": {
   "version": null,
   "applies_to": null,
   "source_incident": "microsoft-authenticator-android-token-bug",
   "sources": [
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80097",
     "title": "NVD: CVE-2026-80097",
     "date": "2026-09-08",
     "kind": "nvd"
    }
   ],
   "covers_everything_listed": false,
   "newest_fix": "Microsoft has patched the app. Update from Google Play. The exact fixed version is not confirmed.",
   "caveats": [
    "These are fixed by an update without one version number we can compare, so check their pages: microsoft-authenticator-android-token-bug."
   ],
   "text": "There is no single version number for Microsoft Authenticator. The newest fix listed here is: Microsoft has patched the app. Update from Google Play. The exact fixed version is not confirmed. If you have that or anything newer, you're covered against the fixed problems listed here (see the notes below)."
  },
  "update_steps": {
   "android": [
    "Open the Google Play Store > Manage apps & device.",
    "Update Microsoft Authenticator."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Microsoft",
  "category": "phones",
  "platforms": [
   "android"
  ],
  "what_it_is": "The phone app that gives you sign-in codes for work and Microsoft accounts.",
  "url": "https://patchgap.ai/is-my-microsoft-authenticator-up-to-date/",
  "json_url": "https://patchgap.ai/products/microsoft-authenticator.json",
  "official_site": "https://www.microsoft.com/security/mobile-authenticator-app",
  "official_download": "https://play.google.com/store/apps/details?id=com.azure.authenticator",
  "how_it_updates": "Update from the Google Play Store.",
  "check": {
   "android": {
    "menu_path": "On your Android phone: open Google Play > tap your picture > Manage apps and device > Updates available.",
    "command": null,
    "shell": null,
    "read_only": null
   }
  },
  "open_incidents": [
   "microsoft-authenticator-android-token-bug"
  ]
 },
 "incidents": [
  {
   "id": "microsoft-authenticator-android-token-bug",
   "url": "https://patchgap.ai/incidents/microsoft-authenticator-android-token-bug/",
   "path": "/incidents/microsoft-authenticator-android-token-bug/",
   "json_url": "https://patchgap.ai/incidents/microsoft-authenticator-android-token-bug.json",
   "title": "Microsoft Authenticator on Android: update the app. A bug could let another app get work-account sign-ins.",
   "category": "phones",
   "platforms": [
    "android"
   ],
   "products": [
    "microsoft-authenticator"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "NVD score 8.6 out of 10 (CVE-2026-80097)",
   "exploited_in_wild": "unknown",
   "exploited_note": "No report that anyone has used this bug.",
   "exploited_source_url": "https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens",
   "confidence": "unconfirmed",
   "confidence_note": "The fixed app version is not listed in the sources we could read. Researchers say Microsoft has patched it.",
   "first_reported": "2026-09-08",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-80097"
   ],
   "summary": "A researcher showed that on Android, another app on the phone could trick the Microsoft Authenticator app into handing over sign-in tokens for a work account (such as email and files). Microsoft has a fix. Update the app from the Play Store.",
   "am_i_affected": "You may be at risk if you use Microsoft Authenticator on an Android phone with a work or school account and have not updated the app recently. iPhone is not mentioned in the sources.",
   "action": "Update Microsoft Authenticator (Android)",
   "affected": [
    {
     "product": "microsoft-authenticator",
     "product_name": "Microsoft Authenticator (Android)",
     "platform": "android",
     "affected_versions": "Microsoft Authenticator for Android with an out-of-date app (exact versions not published in our sources)",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft has patched the app. Update from Google Play. The exact fixed version is not confirmed.",
     "fixed_source_urls": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-80097"
     ],
     "check": {
      "menu_path": "On your Android phone: open Google Play > tap your picture > Manage apps and device > Updates available.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://play.google.com/store/apps/details?id=com.azure.authenticator"
    }
   ],
   "fix_steps": [
    "Open the Google Play Store.",
    "Tap your picture > Manage apps and device > Updates available.",
    "Update Microsoft Authenticator.",
    "Remove apps you do not use or trust."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft Authenticator on Google Play",
     "url": "https://play.google.com/store/apps/details?id=com.azure.authenticator"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80097",
     "title": "NVD: CVE-2026-80097",
     "date": "2026-09-08",
     "kind": "nvd",
     "official": true
    },
    {
     "url": "https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens",
     "title": "Enclave AI: AuthMask, Microsoft Authenticator hands over tokens",
     "date": "2026-10-23",
     "kind": "research",
     "official": false
    }
   ]
  }
 ]
}