CVE-2026-80097: How a Zero-Permission Android App Could Steal Your Corporate Microsoft Tokens
Executive Summary
In October 2026, security researcher Ofek Levin of Enclave disclosed CVE-2026-80097, an 8.6 CVSS-rated flaw in Microsoft Authenticator for Android that allowed any unprivileged app to impersonate trusted Microsoft applications such as Teams and harvest OAuth tokens for a victim's work account. The vulnerability resided in the publicly accessible AccountChooserActivity component, which accepted attacker-supplied identity claims and performed a flawed signature check that could be bypassed because the legitimate target app was genuinely installed on the device. Tokens returned in testing granted read/write access to corporate email, files, and calendars. Microsoft patched the flaw in Authenticator version 6.2606.4246 as part of September 2026 Patch Tuesday.
This incident illustrates the continued risk of over-privileged mobile authentication brokers and weak inter-app trust validation. As enterprises expand mobile-first workforce strategies, OAuth token theft via mobile app impersonation is emerging as a high-value, low-noise vector that bypasses traditional perimeter defenses and directly compromises identity infrastructure.
Why This Matters Now
Mobile authentication brokers are now critical chokepoints for enterprise identity, yet they operate largely outside the visibility of network security controls. CVE-2026-80097 demonstrates that a zero-permission Android app can silently harvest corporate OAuth tokens, granting full access to email, files, and calendars — making this a high-priority patch for any organization using Microsoft 365 on managed or BYOD Android devices.
Attack Path Analysis
An attacker installs a malicious Android app that exploits CVE-2026-80097 in Microsoft Authenticator by invoking the exposed AccountChooserActivity component and spoofing the identity of a trusted app such as Teams, bypassing the signature check to obtain a valid OAuth token for the victim's work account. With the stolen token in hand, the attacker gains full delegated access to the victim's email, files, and calendar, enabling silent data exfiltration of sensitive enterprise content without further credential exploitation.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker distributes a malicious Android application, which may carry no declared permissions, to the victim's device via a third-party app store, phishing link, or sideload. Once installed, the app invokes the publicly accessible AccountChooserActivity component exposed by Microsoft Authenticator (CVE-2026-80097), supplying attacker-controlled values including a spoofed app identity claiming to be Microsoft Teams.
Related CVEs
CVE-2026-80097
CVSS 8.6A token hijacking vulnerability in Microsoft Authenticator for Android allows a malicious app with no special permissions to impersonate a trusted Microsoft application such as Teams by exploiting a broken signature verification check in the AccountChooserActivity broker component, enabling unauthorized retrieval of OAuth tokens granting access to the victim's work account email, files, and calendar.
Affected Products:
Microsoft Microsoft Authenticator for Android – < 6.2606.4246
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Steal Application Access Token
Use Alternate Authentication Material: Application Access Token
Masquerading: Invalid Code Signature
Exploit Application
Steal Web Session Cookie
Valid Accounts: Cloud Accounts
Data Manipulation: Stored Data Manipulation
Email Collection: Remote Email Collection
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Authenticator Management: PKI-Based Authentication
Control ID: IA-5(2)
PCI DSS 4.0 – Application and System Account Authentication Management
Control ID: Requirement 8.6.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA (EU 2022/2554) – ICT Security — Authentication and Access Controls
Control ID: Article 9(4)(b)
NIS2 Directive (EU 2022/2555) – Authentication and Access Management Security Measures
Control ID: Article 21(2)(i)
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Verification and Token Integrity
Control ID: Identity Pillar — Advanced Stage: Continuous Validation
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
CVE-2026-80097 exposes Android Microsoft Authenticator broker flaws enabling permissionless token theft, threatening IT environments reliant on OAuth identity flows, Zero Trust segmentation, and NIST.800-53.AC-6 least-privilege enforcement across managed device fleets.
Financial Services
Identity credential theft via spoofed Microsoft Teams tokens grants full email, file, and calendar access, undermining PCI.4.0 compliance, egress security controls, and privileged account integrity within regulated financial services authentication pipelines.
Health Care / Life Sciences
Stolen work account tokens exposing Microsoft Graph permissions violate HIPAA.164.312(a)(2)(iv) and HIPAA.164.308(a)(3), risking unauthorized access to patient records and clinical workflows on Authenticator-managed Android devices in healthcare organizations.
Government Administration
Permissionless Android app impersonation of trusted Microsoft apps threatens government Azure AD environments, undermining ZTMM identity controls, NIST.CSF.PR.AC-4 access policies, and CISA-tracked credential integrity across federally managed mobile device infrastructure.
Sources
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokenshttps://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.htmlVerified
- CVE-2026-80097 - Microsoft Security Response Center Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097Verified
- AuthMask: We Made Microsoft Authenticator Hand Over Tokens - Enclave Researchhttps://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokensVerified
- Microsoft Patches Record 974 Flaws - September 2026 Patch Tuesday Coveragehttps://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This attack exploits a mobile OAuth token theft vulnerability to gain delegated access to Microsoft 365 cloud workloads, making Aviatrix Zero Trust CNSF relevant because the attacker's lateral reach across Exchange Online, SharePoint, and OneDrive depends entirely on uncontrolled bearer token reachability across cloud-hosted services. By enforcing workload segmentation, identity-aware routing, and controlled egress paths, Aviatrix CNSF would likely reduce the attacker's ability to pivot freely across cloud resources and exfiltrate data without detection.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF fabric would likely constrain reachability of untrusted or unmanaged endpoint traffic attempting to interact with enterprise cloud entry points, reducing the surface area available to a compromised mobile device initiating unauthorized OAuth flows toward cloud-hosted identity infrastructure.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely limit the scope of what a token issued from an unverified or anomalous context could reach within the cloud environment, reducing the attacker's ability to immediately exercise broad delegated privileges across all Microsoft 365 workloads without hitting segmentation boundaries.
Control: East-West Traffic Security
Mitigation: East-west traffic security enforcement would likely reduce the attacker's ability to pivot freely between cloud-hosted workloads using a stolen token, constraining lateral reachability across Microsoft 365 service segments and limiting how broadly a single compromised credential can traverse cloud resource boundaries.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control capabilities would likely surface anomalous outbound HTTPS communication patterns from cloud workloads or managed endpoints, reducing the attacker's ability to operate covert command and control channels through cloud-hosted relay infrastructure without that traffic being observable and subject to policy.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely constrain outbound data transfer paths available to the attacker, reducing the reachability of attacker-controlled endpoints from cloud workload segments and limiting how freely bulk data retrieved via Graph API calls could be transmitted to unauthorized external destinations.
Even with a valid token in hand, the attacker's practical impact would likely be reduced in scope because prior segmentation and egress controls constrain which workload segments and external destinations remain reachable, meaning that the full breadth of email, file, and calendar access would likely face narrowed blast radius rather than unconstrained tenant-wide exposure.
Impact at a Glance
Affected Business Functions
- Corporate Identity and Access Management (IAM)
- Enterprise Email and Collaboration (Microsoft 365 / Exchange Online)
- Cloud File Storage and Document Management (OneDrive / SharePoint)
- Mobile Device and Endpoint Security
Estimated downtime: N/A
Estimated loss: N/A
Work account OAuth tokens granting access to corporate email (read and send), cloud-stored files (read and write via OneDrive and SharePoint), and calendar data (read and write) for the signed-in user on the affected device. Tokens are scoped to Microsoft Graph permissions and apply to the enterprise work account bound to Microsoft Authenticator on the compromised Android device. While individual token scope is per-user, at organizational scale this could expose sensitive business communications, confidential documents, intellectual property, and employee scheduling data. Token validity post-exploitation and potential for lateral movement within Microsoft 365 tenants amplifies data exposure risk.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation and identity-based access policies so that OAuth token issuance is gated on verified device posture and application identity, ensuring no unverified app can obtain delegated tokens even if broker components are abused.
- • Deploy Egress Security and Policy Enforcement controls to detect and block outbound HTTPS transmissions of OAuth tokens or bearer credentials to unauthorized external destinations, using FQDN filtering and data-in-transit inspection aligned with NIST.800-53.SC-18 and PCI.4.0.3.5.1.
- • Activate Multicloud Visibility and Control capabilities to baseline and monitor Microsoft Graph API call patterns per user identity, alerting on anomalous enumeration of mail, files, or calendar resources that deviate from established behavioral norms.
- • Apply Encrypted Traffic inspection (HPE) and Cloud Firewall egress controls to ensure that token exfiltration attempts over covert HTTPS channels are subject to policy enforcement and are not permitted to reach attacker-controlled infrastructure without inspection.
- • Mandate mobile device management enforcement of minimum Authenticator app versions (6.2606.4246 or later) and integrate device compliance posture checks into Zero Trust access policies so that devices running vulnerable broker versions are denied token issuance to enterprise resources.
