Microsoft Authenticator: Token theft via AccountChooserActivity (CVE-2026-80097)

Microsoft has addressed a vulnerability (CVE-2026-80097) in the Microsoft Authenticator app for Android that enabled unauthorized applications to impersonate trusted services (e.g., Teams, Outlook). The flaw resided in the 'AccountChooserActivity' component, which could be invoked by any installed application to initiate a token request. By supplying spoofed metadata, an attacker could deceive the Authenticator broker into returning valid authentication tokens for a user's work account. Microsoft confirms that successful exploitation requires the victim to complete a sign-in flow within the application. The vulnerability is rated "Important" with a CVSS score of 8.6. There is no evidence of exploitation in the wild.

Impact

Successful exploitation allows an attacker to authenticate as the victim, granting full access to resources accessible via the Microsoft Graph API, including email, files, and calendar items associated with the work account signed into the Authenticator app on the device.

Recommendation

• Update Microsoft Authenticator for Android to version 6.2606.4246 or later immediately.
• For organizations using Mobile Device Management (MDM), enforce a minimum version policy for Microsoft Authenticator across all managed Android endpoints.
• Review and audit application permissions on mobile devices to identify and remove suspicious or unauthorized apps that may be leveraging this or similar brokering components.