Enclave’s October 23, 2026 technical account described a proof of concept for CVE-2026-80097, a vulnerability in Microsoft Authenticator for Android. Enclave said an app with no Android permissions could impersonate a Microsoft app and obtain tokens for the work account signed in to Authenticator. The reported fix is version 6.2606.4246 or later.
Microsoft assigned the CVE on September 8, 2026, according to The Hacker News. Enclave’s October 23 disclosure date refers to its published technical account.
How the Authenticator broker trusted the wrong caller
Enclave traced the token handoff to com.microsoft.identity.client.AccountChooserActivity, an Android activity the researchers said was exported. An exported activity can be launched by another app on the device.
In Enclave’s account, the activity accepted request details supplied by the calling app, including its claimed app name, package, client ID, redirect URI, and requested scopes. The activity read the actual caller’s package but did not use that identity to decide whether to trust the request. Enclave said its proof of concept used this path to impersonate an installed Microsoft app.
Which tokens and permissions did the demonstration return?
Enclave reported that the returned bundle contained three token types in plaintext: an access token, used to access a resource; a refresh token, used to obtain new access tokens; and an ID token, which carries information about an authenticated user.
The permissions depended on which Microsoft app the proof of concept impersonated. In Enclave’s Microsoft Teams and Microsoft Graph test, the requested scopes included reading and sending mail, writing files and calendars, sending chat messages, and writing to SharePoint sites. Separate tests impersonating the Teams chat backend and Authenticator’s own client returned different scopes. The Authenticator-client example included UserAuthenticationMethod.ReadWrite, Passkey.Create, and Passkey.Delete.
Enclave’s results concern its proof-of-concept cases. They do not mean every signed-in account received all of these permissions. The reported account scope was the work account signed in to Authenticator on the affected device.
Why do the accounts differ on user interaction?
Enclave said its proof of concept needed no interaction beyond Authenticator being present with a work account signed in. The Hacker News reported Microsoft’s position that exploitation required the user to complete an authentication flow in Authenticator. Those are distinct accounts of the required interaction.
The Hacker News also reported that Microsoft had not observed exploitation. It said the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog did not list the flaw as of October 26, 2026. That catalog status is specific to that date.
Which version fixes CVE-2026-80097?
Enclave identified Microsoft Authenticator for Android versions before 6.2606.4246 as affected. Enclave and The Hacker News reported version 6.2606.4246 or later as the fix, giving Android users and administrators a specific version threshold to check.
The Hacker News reported a CVSS score of 8.6 and Microsoft’s severity label as “Important.” Enclave also gave the score as 8.6, while labeling it “High.”
NeoTeo’s October Microsoft Patch Tuesday coverage concerns Windows vulnerabilities; CVE-2026-80097 affects Microsoft Authenticator for Android.
