CVE-2026-80097

Successful exploitation compromises the confidentiality and integrity of resources accessible through the victim's signed-in work account. Researchers demonstrated Microsoft Graph access permitting reading and sending email, reading and modifying files and calendars, accessing SharePoint content, and sending Teams messages as the victim. Available access depends on the impersonated client, token scopes, and the user's existing permissions. Researchers also demonstrated impersonating Authenticator to modify account sign-in methods, including adding or deleting passkeys; an attacker-added passkey could preserve account access after removal of the malicious application. The vulnerability does not establish Android root access or arbitrary code execution.

Restrict sideloading and installation of untrusted applications, enforce enterprise mobile application controls, and use mobile threat detection to identify suspicious applications. Monitor Microsoft Entra ID sign-in events and Microsoft Graph activity for unexpected token use, unusual resource access, and changes to authentication methods. Correlate identity events with mobile endpoint telemetry. These measures reduce exposure or support detection but do not replace updating the vulnerable broker.

Update Microsoft Authenticator for Android to version 6.2606.4246 or later through Google Play. Enforce the minimum fixed version across managed devices using MDM or EMM and verify deployment. If exploitation is suspected, remove the malicious application, revoke affected users' sign-in sessions, investigate token and account activity, and review registered authentication methods for unauthorized additions. Whether updating Authenticator invalidates previously stolen tokens is not established.