news
The Hacker News
October 27th, 2026 at 12:09 PMMicrosoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,
#research
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 2.98
Engagement proxy: 0
Canonical link: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html