Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft patched a security flaw in its Android Authenticator app that allowed permissionless apps to impersonate trusted Microsoft apps and steal work account tokens, risking access to emails, files, and calendars. The vulnerability, tracked as CVE-2026-80097, required user interaction and has not been exploited in the wild.