Microsoft fixes CVE-2026-80097 in Android Authenticator, blocking token theft

En bref

• Microsoft released a fix for CVE-2026-80097 in its Android Authenticator.
• Hostile apps could pretend to be trusted and harvest workplace authentication tokens.
• Android users and apps that request no permissions are in scope.
• Teams is also listed among the products; install current versions.

A fix for the security flaw CVE-2026-80097 in Microsoft’s Android Authenticator app has been issued by the company, with the issue credited to security researchers. The problem allowed hostile mobile programs to masquerade as software users already trust and then harvest authentication tokens tied to workplace accounts. Because those tokens can represent an established session, the chain can end in account takeover. Microsoft states that the flaw is fixed, and the practical response is to install the newest build.

The exposure is relevant to people on Android and to programs that ask for no permissions. That detail matters: an app with no permission prompts may appear benign while still exploiting trust in a familiar brand. Microsoft's Teams product also appears in the product scope. The issue is dated to 2026.

Token theft is consequential because it can bypass the usual password step; an attacker with a valid token may reach work resources without knowing the user's credentials. Trusted-app impersonation on mobile is also hard for users to spot, since names and icons are easy to copy. Permissionless apps reduce the warning signs that might otherwise prompt a user to stop.

With a fix available, the priority is verification and hygiene: confirm Android Authenticator and Teams are current, remove unrecognized sideloaded software, and review identity logs for token replay or unusual sign-ins. Watch for follow-up Microsoft guidance on CVE-2026-80097 and for fake apps that claim to be trusted tools.

À faire maintenant

1. Update Microsoft Authenticator for Android and Teams to the latest versions from the official Google Play listing; verify the installed version after updating.
2. Inventory Android endpoints, including BYOD and shared devices, and confirm which ones still run older Authenticator builds.
3. Review Entra ID or Microsoft 365 sign-in logs for anomalous token use, unfamiliar apps, or impossible travel; revoke sessions and refresh tokens for suspicious accounts.
4. Remove sideloaded or unrecognized apps from managed Android devices and block installs from unknown sources where policy allows.
5. Enforce device compliance and app protection policies so only managed, up-to-date Android devices can access work resources.
6. Tell staff to check the publisher before installing Microsoft-branded apps and to report unexpected authentication prompts.
7. Track Microsoft's advisory for CVE-2026-80097 and apply any additional mitigation guidance.

Références CVE

• CVE-2026-80097

Source originale

The Hacker News