Android uchun Microsoft Authenticator'dagi yuqori darajadagi zaiflik zararli ilovaga, Android'da hech qanday ruxsatlarsiz, ishonchli Microsoft ilovalarini taqlid qilish va jabrlanuvchining ish hisobiga kirgan autentifikatsiya tokenlarini o'g'irlashga imkon berishi mumkin.
Bu zaiflik CVE-2026-80097 sifatida kuzatiladi va 6.2606.4246 dan oldingi Microsoft Authenticator versiyalariga ta'sir qiladi. Microsoft shundan beri tuzatish chiqardi.
Enclave'dagi xavfsizlik tadqiqotchilari muammoning manbai com.microsoft.identity.client.AccountChooserActivity deb nomlangan eksport qilingan Android faoliyati ekanligini aniqladilar.
Bu faoliyat ilova tashqarisidan foydalanish mumkin bo'lgani uchun, qurilmadagi boshqa ilova uni ishga tushirishi va Authenticator'ning broker xizmati orqali tokenlarni so'rashi mumkin edi.
Zaif ish oqimi so'rov yuboruvchi ilova tomonidan taqdim etilgan identifikatsiya ma'lumotlariga ishonardi, jumladan da'vo qilingan paket nomi, mijoz ID, qayta yo'naltirish URI, qamrovlar va hatto chaqiruvchining UID'si.
Authenticator qayta yo'naltirish URI tekshiruvini amalga oshirgan bo'lsa-da, u faqat da'vo qilingan ilova paketi uchun imzo asosidagi qayta yo'naltirish URI'sini tekshirdi, haqiqiy chaqiruvchi ilova o'sha paketga mos kelishini tasdiqlamadi.
Bu e'tiborsizlik hujumchiga o'rnatilgan Microsoft ilovasini, masalan Microsoft Teams'ni, taqlid qilishga imkon berdi. Ular qonuniy ilovaning o'rnatilgan imzosidan kutilgan qayta yo'naltirish URI'sini tuzib, tekshiruvdan o'tishlari mumkin edi.
Tadqiqot shuni ko'rsatdiki, Authenticator haqiqiy chaqiruvchini Android'ning getCallingActivity() mexanizmi orqali aniqlay olgan bo'lsa-da, bu ma'lumotni xavfsizlik qarorlarida ishlatmadi.
So'rov qabul qilingandan so'ng, Authenticator token ma'lumotlarini faoliyat natijasi orqali so'rov yuboruvchi ilovaga qaytarardi. Tadqiqotchilarning aytishicha, bu qaytarilgan broker javobi kirish tokenlari, yangilash tokenlari, ID tokenlari va mijoz ma'lumotlarini ochiq matnda o'z ichiga olishi mumkin edi, bu esa zararli ilovaga ularni tahlil qilish va qayta ishlatishga imkon berardi.
Sinovda Microsoft Teams'ni taqlid qilib, Microsoft Graph'ga kirish so'ralganda, delegatsiya qilingan ruxsatlar pochta qutisi, taqvim, fayllar, SharePoint va chat bilan bog'liq harakatlarga ruxsat berishi mumkin edi.
Tadqiqotchilar shuningdek, Teams orqa fon mijozini va Authenticator'ning o'z mijoz identifikatsiyasini taqlid qilib, har xil ruxsat qamrovlari bilan token berilishini namoyish etdilar.
Microsoft CVE-2026-80097'ni imtiyozlarni oshirish zaifligi sifatida tasnifladi, unga CVSS balli 8.6 ni berdi va CWE-287, Noto'g'ri autentifikatsiya bilan bog'ladi. Microsoft hisobotni tasdiqladi, tuzatishni chiqardi va 2026-yil 8-sentabrda zaiflik haqida maslahat e'lon qildi.
Android'da Microsoft Authenticator'dan foydalanadigan tashkilotlar o'z qurilmalarida 6.2606.4246 yoki undan keyingi versiya ishlayotganini ta'minlashlari kerak. Mobil tahdidlarni aniqlash jamoalari shuningdek, boshqariladigan Android qurilmalarida kutilmagan token ishlatilishi, shubhali Microsoft Graph faoliyati va boshqariladigan Android qurilmalarida ruxsatsiz ilova xatti-harakatlarini kuzatishlari kerak.
A high-severity vulnerability in Microsoft Authenticator for Android could let a malicious app, without any Android permissions, impersonate trusted Microsoft apps and steal authentication tokens for a victim’s signed-in work account.
This vulnerability is tracked as CVE-2026-80097 and affects Microsoft Authenticator versions earlier than 6.2606.4246. Microsoft has since issued a patch.
Security researchers at Enclave discovered that the problem originated from an exported Android activity called com.microsoft.identity.client.AccountChooserActivity.
Because this activity was accessible from outside the app, another app on the device could launch it and request tokens through Authenticator’s broker service.
The vulnerable workflow trusted identity details supplied by the requesting app, which included the claimed package name, client ID, redirect URI, scopes, and even the caller’s UID.
While Authenticator did perform a redirect-URI validation check, it merely verified the signature-derived redirect URI for the claimed app package instead of confirming that the real calling application matched that package.
This oversight meant that an attacker could masquerade as an installed Microsoft application, such as Microsoft Teams. They could construct the expected redirect URI from the legitimate app’s installed signature and pass validation.
Research showed that while Authenticator could identify the real caller through Android’s getCallingActivity() mechanism, it did not use this information in its security decisions.
Once the request was accepted, Authenticator would return token data to the requesting app via the activity result. According to the researchers, this returned broker response could contain access tokens, refresh tokens, ID tokens, and client information in plaintext, enabling the malicious app to parse and reuse them.
In testing,impersonating Microsoft Teamswhile requesting access to Microsoft Graph resulted in delegated permissions that could allow mailbox, calendar, file, SharePoint, and chat-related actions.
The researchers also demonstrated that token issuance could occur while impersonating a Teams backend client and Authenticator’s own client identity, each with different permission scopes.
Microsoft classified CVE-2026-80097 as an elevation-of-privilege vulnerability, assigning it a CVSS score of 8.6 and mapping it to CWE-287, Improper Authentication. Microsoft has confirmed the report, issued a fix, and published the vulnerability advisory on September 8, 2026.
Organizations using Microsoft Authenticator on Android should ensure that their deployed devices are running version 6.2606.4246 or later. Mobile threat detection teams should also monitor managed Android devices for unexpected token use, suspicious Microsoft Graph activity, and unauthorized application behavior on managed Android devices.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.