Microsoft Fixes Android Authenticator Bug That Exposed Account Tokens

WHO:

TechRadar - Microsoft and users of its Authenticator app for Android were affected by the flaw.

Techmeme (Abinaya / Cyber Security News) - Microsoft patched the flaw in its Android Authenticator app.

WHAT:

TechRadar - A critical flaw allowed malicious Android apps to steal account access tokens; the bug has been fixed.

Techmeme (Abinaya / Cyber Security News) - Microsoft patched high-severity vulnerability CVE-2026-80097, rated CVSS 8.6.

Techmeme (Abinaya / Cyber Security News) - The flaw could let untrusted apps impersonate Microsoft apps and obtain delegated account tokens.

TechRadar - Authenticator was granting session tokens.

HOW:

TechRadar - Malicious Android apps could exploit the Authenticator flaw to obtain session tokens and access accounts.

Techmeme (Abinaya / Cyber Security News) - Untrusted apps could impersonate Microsoft apps and obtain delegated account tokens.

(UPDATED October 27, 2026 16:10 UTC)

Microsoft has fixed a high-severity flaw in its Android Authenticator app that could let malicious apps steal account access. The vulnerability, identified as CVE-2026-80097 and rated 8.6, allowed untrusted apps to impersonate Microsoft apps and obtain delegated session tokens. Those tokens could then be used to access users’ accounts.