Microsoft Authenticator Android Flaw: Why UK Organisations Should Verify Their MFA App Is Updated

Help Net Security has reported on a now-patched vulnerability in Microsoft Authenticator for Android, tracked as CVE-2026-80097, which allowed any application installed on the same device to silently obtain a user's work account authentication tokens without requiring any permissions or user interaction. The flaw was discovered by researchers at Enclave, who found that it exploited Authenticator's role as an authentication broker on Android. When Microsoft applications such as Teams or Outlook need to sign a user in, they request a token from Authenticator, which acts as an intermediary. The vulnerability allowed a rogue application to intercept this brokering process and obtain valid tokens for the user's Microsoft work account — effectively bypassing multi-factor authentication without triggering any visible alert or prompt. Microsoft has released a patch, and users are advised to update the Android application immediately.

Why this matters for UK organisations

Microsoft 365 is deeply embedded in the working practices of a large proportion of UK businesses, and Microsoft Authenticator is one of the most widely deployed tools for securing access to those environments. Multi-factor authentication is rightly promoted as one of the most effective and accessible security controls available, but this incident is a useful reminder that MFA implementations depend on the security of the tools that deliver them. A compromised work account can provide access to email, files, SharePoint, Teams conversations, and connected business systems — and in this case, the compromise could occur silently, with no notification to the user or the IT team. The risk is compounded by the fact that many organisations have limited visibility into the applications installed on employee-owned or bring-your-own-device handsets, making it harder to detect or prevent a rogue app from being present on a device that also runs Authenticator.

What to review

The immediate priority is to confirm that all users of Microsoft Authenticator on Android have updated to the patched version of the application. Where mobile device management tooling is in place, this update should be enforced across managed devices as a matter of priority. IT and security teams should also review authentication logs for any anomalous sign-in activity that may have occurred during the period the vulnerability was present, paying particular attention to token-based access from unexpected locations or devices. Longer term, this incident is a prompt to review mobile device management policies, consider whether bring-your-own-device arrangements provide sufficient visibility and control, and ensure that MFA app updates are included in standard patch management processes rather than left to individual users to apply at their own discretion.

Source: Help Net Security