Microsoft has fixed a security flaw in Microsoft Authenticator for Android that could have allowed a malicious app to impersonate a trusted Microsoft application and obtain sign-in tokens for a user's work account. The issue, tracked as CVE-2026-80097, was patched in Microsoft Authenticator for Android version 6.2606.4246.

For European businesses that rely on Microsoft 365, Entra ID, Teams and mobile authentication workflows, the update matters because stolen account tokens can create a path to business email, files, internal chat and other cloud services without needing a user's password.

What happened

According to the reported findings, the flaw allowed a malicious Android app with no special permissions to present itself as if it were a legitimate Microsoft application, such as Teams, during an authentication flow. In the researchers' testing, this could result in Microsoft Authenticator issuing work account tokens to the rogue app.

Microsoft has addressed the issue in its Android app update. Based on the source information, the affected scenario concerns Microsoft Authenticator on Android. The report does not indicate that this was a broad compromise of all Microsoft accounts, but rather a vulnerability in a specific mobile authentication flow.

Why it matters for European businesses

Identity systems are a core part of modern business security. In many organisations, access to email, collaboration tools, cloud storage, CRM platforms and internal apps depends on tokens issued after authentication. If those tokens are exposed, an attacker may be able to act as a signed-in user until the token expires or is revoked.

That creates several business risks:

• Account access without password theft: token theft can bypass the need to capture credentials directly.
• Exposure of business data: email, documents, chats and connected Microsoft 365 services may be at risk depending on the token scope.
• Mobile device security gaps: companies often focus on phishing and endpoint protection, but less attention is sometimes given to mobile identity flows.
• Compliance and incident response implications: if business accounts or personal data are accessed, organisations may need to assess regulatory and contractual obligations, including GDPR-related review where relevant.

This is especially relevant for SMEs that depend heavily on Microsoft cloud services but may have limited mobile device management or app governance in place.

Who may be affected

The issue is most relevant to organisations where staff use Android devices together with Microsoft Authenticator for work sign-in. This may include:

• SMEs using Microsoft 365 and Entra ID for identity and access management
• Companies with bring-your-own-device policies involving Android phones
• Sales, support and leadership teams accessing work accounts on mobile devices
• IT departments managing conditional access and mobile authentication policies
• Regulated businesses that must demonstrate stronger access control and incident handling

The source specifically refers to Android and Microsoft Authenticator. Businesses should avoid assuming the same issue affects iPhone users or other authentication apps unless confirmed by Microsoft or their own security teams.

What companies should consider

• Update immediately: confirm that Microsoft Authenticator on Android is updated to version 6.2606.4246 or later.
• Check update coverage: verify whether company-managed and BYOD Android devices actually received the patch.
• Review mobile app controls: consider whether employees can install untrusted apps on devices used for work authentication.
• Monitor identity logs: review Entra ID and Microsoft 365 sign-in activity for suspicious sessions, unusual app access or anomalous device behaviour.
• Prepare token response actions: ensure IT teams know how to revoke sessions or tokens quickly if compromise is suspected.
• Strengthen mobile security policy: where practical, use mobile device management, application protection policies and approved app lists for higher-risk roles.

For businesses already standardised on Microsoft identity services, this appears to be a patch-and-verify issue rather than a reason to change platform. The more important lesson is that mobile authentication apps are part of the identity attack surface and should be included in routine update, monitoring and access-control processes.