Is Microsoft Authenticator safe? What the Android token bug means

Microsoft Authenticator is safe to use if you’re running version 6.2606, build forty-two forty-six, or anything newer on Android. In Settings it shows as 6.2606 followed by that build number. Every earlier Android version has the flaw, which Microsoft tracks as CVE-2026-80097 and rates 8.6 out of 10 on the standard severity scale, a level it labels Important.

To check your version, open the Google Play Store, search for Microsoft Authenticator and tap Update if the button appears. You can also open the app’s info page in your phone’s Settings, under Apps, where the version number is listed near the bottom.

The flaw was only in the Android app. It affected work or school accounts signed in to Authenticator on that phone, not other accounts.

On Android, Authenticator does a lot more than show six-digit codes. It also works as a broker, a middleman for sign-ins. Say Outlook or Teams wants to sign you in. Instead of asking for your password, it requests a token from Authenticator, which works like a backstage pass showing you’ve already logged in.

Ofek Levin, a researcher in a fellowship program at security firm Enclave, found that Authenticator trusted what an app said about itself. Part of the app, a screen called AccountChooserActivity, could be opened by any other app on the phone. A rogue app could open it, say it was Teams, and ask for Teams’ token.

There was a safety check, but it checked the wrong thing. Authenticator looked up the real Teams app’s digital signature on the phone and confirmed the request matched it. Since Teams was really installed, the details were there for anyone to read, and the check passed. Authenticator could actually see which app was asking. It just didn’t use that to decide.

In Enclave’s tests, a fake Teams app got tokens that worked across a person’s work account. The researchers could:

• Read your email and send messages as you.
• Read and change your files, calendar and SharePoint sites.
• Send Teams messages in your name.
• By posing as Authenticator itself, change how the account signs in, including creating and deleting passkeys.

That last one is the scary part. A passkey is a login key stored on a device. If an attacker adds their own passkey to your account, they can keep getting in even after you delete the bad app from your phone.

Here’s what makes this bug unusual. Most dangerous Android apps give themselves away by asking for lots of permissions, like access to your contacts, messages or screen. This one needed none at all, so the usual warning sign wasn’t there.

Enclave says its test app collected tokens silently, with no prompt and no tap, as long as a work account was signed in. Microsoft’s advisory says an attack also needs the victim to install a malicious app and then complete a sign-in step in Authenticator. Its severity score reflects that.

Both agree on the first hurdle: a bad app has to get onto your phone. That usually means installing something from outside the Google Play Store, a practice called sideloading, or being tricked into installing a fake app.

Microsoft rates exploitation as less likely, and the flaw isn’t on the US government’s list of bugs known to be used in attacks. It also wasn’t one of the two Windows flaws Microsoft flagged as already under attack in September.

If you use Authenticator for a work or school account on Android, three quick steps cover you:

1. Update Authenticator from the Google Play Store and confirm the version is 6.2606 with build forty-two forty-six, or newer.
2. Look through your installed apps for anything you don’t remember adding, especially apps installed from outside the Play Store. Delete them.
3. If something looks off, tell your IT team. They can check your account’s sign-in methods for passkeys you didn’t create and sign out other sessions.

If you’re the IT team, set that fixed build of version 6.2606 as the minimum Authenticator version in your device management tool. One question remains open: Microsoft hasn’t said whether updating cancels a token a malicious app may already have taken. Until it does, resetting sessions for anyone you’re worried about is the safer move.

On an iPhone? This bug was specific to Android. Keeping Authenticator updated is still good practice everywhere.