What Happened
The Hacker News reports Enclave published details of CVE-2026-80097, a CVSS 8.6 flaw in Microsoft Authenticator for Android. An exported activity, AccountChooserActivity, accepted an app name supplied by the caller. Authenticator checked a signature against the real Teams app, and the check passed because Teams was installed. It never used the calling app’s identity to decide whether to issue a token.
In Enclave’s tests, a malicious app posing as Teams obtained Microsoft Graph tokens to read and send mail, work with files, and edit calendars. Microsoft fixed the flaw in version 6.2606.4246 during September Patch Tuesday. It says it saw no exploitation and rates exploitation less likely. Enclave says its proof of concept needed no user interaction. Microsoft disagrees and says the user must complete an authentication flow.
Why This Matters for Canadian Organizations
The report does not mention Canada. Authenticator is the standard MFA app in Microsoft 365 tenants across Canadian banks, hospitals, school boards, and governments. Many staff run it on personal Android phones. A rogue app on one of those phones puts mail and files at risk with no password theft.
Microsoft has not said whether updating revokes tokens a malicious app already holds. Until it does, you cannot treat the patch as full cleanup. Mail and file access also carries PIPEDA breach obligations if personal information is exposed.
What to Do
Set 6.2606.4246 as the minimum version in your mobile device management policy. Block outdated Authenticator installs from accessing corporate resources. Review sign-in logs for unusual Graph API activity from Android devices. Revoke refresh tokens for high-risk users as a precaution. See our TechTalk archive for related vulnerability analysis.
