Security AlertMedium
Microsoft patches Android Authenticator token theft flaw
Oct 27, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
Microsoft fixed CVE-2026-80097 in Authenticator for Android. The flaw let a malicious app impersonate Microsoft apps and collect work account tokens.
Key points
- The issue affected Microsoft Authenticator for Android.
- Researchers said stolen tokens could open email, files and calendar access.
- Microsoft says the flaw has not been used in attacks.
Why it matters
Anyone using Microsoft work apps on Android should update Authenticator. If a phone is compromised, stolen tokens could expose work email, files and calendar data.
Who’s affected: Microsoft Authenticator for Android users
What to do
- Update Microsoft Authenticator for Android to version 6.2606.4246 or later.
- Review Android device app installation practices.
- Watch Microsoft guidance for managed devices.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.