Enclave researcher Ofek Levin showed that an Android app with no permissions at all could pose as Microsoft Teams and obtain work account access tokens from Microsoft Authenticator. With them it could reach email, files, calendar and Teams chats. The problem was that Authenticator checked the identity the app claimed rather than the app actually making the request. Microsoft fixed the flaw as CVE-2026-80097 in version 6.2606.4246 and reports no attacks.

What it means: For many companies Microsoft Authenticator is the key to everything: email, files, Teams and apps that sign in through Entra ID. A flaw that lets a seemingly harmless app, without even asking for permissions, gain access to all of this shows that an employee's phone is part of the company perimeter, whether the company manages it or not. Microsoft says the victim had to complete a sign-in step, while the researchers say no interaction was needed; either way, the fix is available. For Greek businesses on Microsoft 365, the first step is to make sure every device runs the latest version of the app, which can be enforced through mobile management tools such as Intune. Conditional access policies that require an updated, compliant device reduce the risk from similar flaws in the future. It is not clear whether the update cancels tokens that may already have been stolen, so if there is any suspicion it is worth revoking user sessions from the admin console.

Read the original on Enclave

Related service: Custom software

Related stories