Microsoft Authenticator: Android app vulnerability

Microsoft Authenticator for Android

A flaw in Microsoft Authenticator on Android allows rogue apps to steal work account access without permissions or user interaction.

Do this now

Update Microsoft Authenticator on Android to 6.2606.4246.

Fix it

Upgrade to Microsoft Authenticator for Android 6.2606.4246

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 07:17 UTC
Fixed in: 6.2606.4246
Identifiers: CVE-2026-80097
CVSS: 8.6
Source: news
On the menu as: Android

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Microsoft Authenticator: Android app vulnerability
Severity: high. Patch status: patched.
Affected: Microsoft Authenticator for Android
Fixed in: 6.2606.4246
Ids: CVE-2026-80097

A flaw in Microsoft Authenticator on Android allows rogue apps to steal work account access without permissions or user interaction.

## Steps
1. Search the repo, its CI and infra config for Microsoft Authenticator for Android. If present, report the version in use and whether it's affected.
2. Fix by release line: Microsoft Authenticator for Android: 6.2606.4246.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Microsoft Authenticator for Android | fixed | 6.2606.4246 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-80097") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/
https://pwned.coffee/i/microsoft-authenticator-android-app-vulnerability

Timeline

27 Oct 2026, 07:17 UTC
Fix status: unknown → patched.
27 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Microsoft Authenticator for Android before 6.2606.4246 6.2606.4246 CVE record (CNA) checked 27 Oct
Score: CVSS 8.6 (high). CVSS 3.1 8.6 (CNA microsoft) for CVE-2026-80097
Last checked: 27 Oct 2026, 08:23 UTC

Product	Affected	Fixed in	Source
Microsoft Authenticator for Android	before 6.2606.4246	6.2606.4246	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

helpnetsecurity.com: Microsoft Authenticator vulnerability let rogue Android apps steal work account access

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee