vulnerability
Imported story
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Source: The Hacker News · Published · Last checked 12 minutes ago · 1 min read
Read original source ↗ (thehackernews.com)
Publisher excerpt From The Hacker News
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.