{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/authenticator--6.2606.4246/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:authenticator:*:*:*:*:*:android:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-80097"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Authenticator (\u003c 6.2606.4246)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft has addressed a vulnerability (CVE-2026-80097) in the Microsoft Authenticator app for Android that enabled unauthorized applications to impersonate trusted services (e.g., Teams, Outlook). The flaw resided in the 'AccountChooserActivity' component, which could be invoked by any installed application to initiate a token request. By supplying spoofed metadata, an attacker could deceive the Authenticator broker into returning valid authentication tokens for a user's work account. Microsoft confirms that successful exploitation requires the victim to complete a sign-in flow within the application. The vulnerability is rated \u0026quot;Important\u0026quot; with a CVSS score of 8.6. There is no evidence of exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to authenticate as the victim, granting full access to resources accessible via the Microsoft Graph API, including email, files, and calendar items associated with the work account signed into the Authenticator app on the device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Microsoft Authenticator for Android to version 6.2606.4246 or later immediately.\u003c/li\u003e\n\u003cli\u003eFor organizations using Mobile Device Management (MDM), enforce a minimum version policy for Microsoft Authenticator across all managed Android endpoints.\u003c/li\u003e\n\u003cli\u003eReview and audit application permissions on mobile devices to identify and remove suspicious or unauthorized apps that may be leveraging this or similar brokering components.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T15:38:30Z","date_published":"2026-10-27T15:38:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-authenticator-flaw/","summary":"A vulnerability in Microsoft Authenticator for Android (CVE-2026-80097) allows malicious applications to impersonate trusted services and intercept sign-in tokens for victim work accounts.","title":"Microsoft Authenticator: Token theft via AccountChooserActivity (CVE-2026-80097)","url":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-authenticator-flaw/"}],"language":"en","title":"CraftedSignal Threat Feed - Authenticator (\u003c 6.2606.4246)","version":"https://jsonfeed.org/version/1.1"}