Microsoft o'zining Android uchun Authenticator ilovasidagi kamchilikni tuzatdi. Bu kamchilik zararli ilovaga hech qanday ruxsatlarsiz o'zini ishonchli Microsoft ilovasi, masalan Teams, sifatida ko'rsatib, jabrlanuvchining ish hisob qaydnomasi uchun kirish tokenlarini yig'ish imkonini bergan.
Microsoft bu kamchilikni CVE-2026-80097 deb kuzatadi va uni Android uchun Authenticator ilovasining 6.2606.4246 versiyasida tuzatgan, shuning uchun ilovadan foydalanadigan har kim uni yangilashi kerak.
Tadqiqotchilarning sinovlarida tokenlar hisob qaydnomasining elektron pochtasi, fayllari va taqvimiga to'liq kirish huquqini bergan. Microsoft aytishicha, ekspluatatsiya qilish uchun jabrlanuvchi Authenticator'da kirish qadamini ham bajarishi kerak, va bu kamchilik hujumlarda ishlatilmagan.
Tadqiqot Enclave xavfsizlik firmasining hamkorlik dasturi orqali ishlaydigan Ofek Levin tomonidan olib borilgan, u texnik tafsilotlarni 2026-yil 23-oktabrda e'lon qilgan. Microsoft CVE'ni 8-sentabrda tayinlagan va uni CVSS shkalasi bo'yicha 8,6 deb baholagan, bu "Muhim" deb belgilangan.
Android'da Authenticator faqat olti raqamli kodlarni ko'rsatishdan ko'proq ish qiladi. U shuningdek broker sifatida ishlaydi: Teams, Outlook yoki boshqa Microsoft ilovasi foydalanuvchini tizimga kiritishi kerak bo'lganda, u Authenticator'dan so'raydi va Authenticator foydalanuvchi tizimga kirganligini isbotlovchi raqamli o'tish — tokenni qaytaradi. Broker butun hisob qaydnomasiga kirishni nazorat qilgani uchun, u qaysi ilovaga token berishini ehtiyotkorlik bilan tanlashi kerak.
Kamchilik noto'g'ri ilovaga token olish imkonini bergan. Authenticator AccountChooserActivity nomli komponentni ochib qo'ygan, uni qurilmadagi har qanday ilova ishga tushirishi mumkin. Hujumchining ilovasi uni ishga tushirganda, Authenticator token so'rovini hujumchining ilovasi taqdim etgan qiymatlardan, jumladan o'zini qaysi ilova deb da'vo qilgan nomidan tuzgan. Ilova o'zini Teams deb aytgan va broker bunga ishongan.
Imzo tekshiruvi buni to'xtatishi kerak edi, lekin u to'xtatmadi. Tekshiruv taqlid qilinayotgan ilovaning haqiqiy imzosini qidirib topgan va so'rov unga mos kelishini tasdiqlagan. Chunki Teams haqiqatan ham qurilmada o'rnatilgan edi, uning haqiqiy imzosi o'qish uchun mavjud edi, shuning uchun tekshiruv muvaffaqiyatli o'tgan.
Enclave topishicha, Authenticator qaysi ilova haqiqatan so'rov yuborganini ham ko'ra olgan, lekin u bu ma'lumotdan token berish-bermaslikni hal qilishda foydalanmagan.
Enclave sinovlarida o'zini Teams deb ko'rsatib, Microsoft Graph tokenlarini so'rash natijasida pochta o'qish va yuborish, fayllarni o'qish va yozish, taqvimlarni o'qish va yozish va boshqa ruxsatlar qaytarilgan.
Microsoft natijani umumiyroq tarzda ta'riflaydi: muvaffaqiyatli hujumchi tizimga kirgan foydalanuvchi sifatida autentifikatsiya qilishi va shu foydalanuvchining resurslariga kirishi mumkin. Tokenlar o'sha qurilmadagi Authenticator'da tizimga kirgan ish hisob qaydnomasiga tegishli, boshqa hisob qaydnomalariga emas.
Ikki tomon bir nuqtada kelishmaydi, bu o'quvchi e'tiborga olishi kerak. Enclave o'zining isbotlovchi kontseptsiyasi tizimga kirgan hisob qaydnomasi mavjudligidan boshqa hech qanday foydalanuvchi o'zaro ta'sirisiz tokenlarni qaytarganini xabar qilgan.
Microsoftning maslahatida aytilishicha, ekspluatatsiya qilish qurilmaga zararli ilovani o'rnatish va foydalanuvchini Authenticator'da autentifikatsiya oqimini bajarishga ishontirishni talab qiladi. Uning CVSS bahosi ham kamchilik foydalanuvchi o'zaro ta'sirini talab qilishini ko'rsatadi.
Microsoft aytishicha, kamchilik ekspluatatsiya qilinmagan va tuzatishdan oldin ommaviy oshkor qilinmagan, va ekspluatatsiya ehtimoli "kamroq" deb baholangan. U kompaniyaning 2026-yil sentabr Patch Tuesday qismi bo'lgan va o'sha oyda allaqachon hujum ostida deb belgilangan ikkita Windows kamchiligidan biri emas. 2026-yil 26-oktabr holatiga ko'ra, bu zaiflik AQSh CISA Ma'lum Ekspluatatsiya Qilingan Zaifliklar katalogida ro'yxatga olinmagan.
Tuzatish — Microsoft Authenticator for Android'ni 6.2606.4246 yoki undan keyingi versiyaga yangilash, bu Microsoft maslahatida havola qilingan. Android qurilmalarini boshqaradigan tashkilotlar o'z qurilma boshqaruvi orqali shu minimal versiyani talab qilishlari mumkin. Microsoft maslahati tuzatishni beradi, lekin yangilash zararli ilova allaqachon olgan har qanday tokenni bekor qiladimi-yo'qmi, bu haqida aytmaydi, shuning uchun bu mavjud manbalardan noaniq qoladi.
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.
Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update.
In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks.
The research comes from Ofek Levin, working through a fellowship program at the security firm Enclave, which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important."
On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when Teams, Outlook, or another Microsoft app needs to sign a user in, it asks Authenticator, and Authenticator hands back a token, a digital pass that proves the user is logged in. Because the broker controls access to the entire account, it should be careful about which app it grants a token to.
The flaw let the wrong app get one. Authenticator exposes a component, an activity named AccountChooserActivity, that any app on the device can start. When the attacker's app started it, Authenticator built its token request from values the attacker's app supplied, including the name of the app it claimed to be. The app said it was Teams, and the broker believed it.
A signature check was supposed to stop this, but it did not. The check looked up the real signature of the app being impersonated and confirmed the request matched it. Because Teams was genuinely installed on the device, its real signature was there to read, so the check passed.
Authenticator could also see which app had actually made the request, Enclave found, but it did not use that to decide whether to hand over a token.
Video 3
In Enclave's tests, posing as Teams and requesting Microsoft Graph tokens returned permissions to read and send mail, read and write files, and read and write calendars, among others.
Microsoft describes the result more generally: a successful attacker could authenticate as the signed-in user and reach that user's resources. The tokens apply to the work account signed into Authenticator on that device, not to other accounts.
The two accounts disagree on one point a reader should weigh. Enclave reported that its proof of concept returned tokens without any user interaction, other than the presence of a signed-in account.
Microsoft's advisory says exploitation requires installing a malicious app on the device and convincing the user to complete an authentication flow in Authenticator. Its CVSS score also indicates that the flaw requires user interaction.
Microsoft says the flaw has not been exploited and was not publicly disclosed before the fix, and rates exploitation as "less likely." It was part of the company's September 2026 Patch Tuesday and was not one of the two Windows flaws flagged that month as already under attack. The vulnerability is not listed in the U.S. CISA Known Exploited Vulnerabilities catalog as of October 26, 2026.
The fix is to update Microsoft Authenticator for Android to version 6.2606.4246 or later, as linked in Microsoft's advisory. Organizations that manage Android devices can require that minimum version through their device management. Microsoft's advisory gives the fix but does not say whether updating cancels any token a malicious app may already have obtained, so that remains unclear from the available sources.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.