The sharpest story in cybersecurity news today is about a guard who checked the wrong ID. Microsoft has fixed a flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and rated 8.6 (Important), that let a malicious app with no permissions pose as a trusted Microsoft app such as Teams and collect sign-in tokens for the victim's work account (The Hacker News, October 27, 2026, reporting the research and Microsoft's advisory). In the researchers' tests, the tokens gave access to the account's email, files, and calendars. This page states what Microsoft and the researchers have published, then gives you a working audit: six questions about your own phone and work setup, scored against the exact pattern this flaw ran on.
Put the shape in proportion. The cryptography held. The signature was genuine, and a signature compared with itself matches 100 percent of the time. What failed was the question the broker asked: it verified that Teams is Teams, when the decision needed which app is asking. Any system that hands out tokens, keys, or sessions on the strength of a claimed identity has the same failure available to it. The audit below scores how much of that shape your own setup carries.
The broker pattern is everywhere now, and phones are only the most visible case. An authenticator broker, an identity provider, an agent gateway: each one sits between a caller and an account, and each one decides who gets a token. CVE-2026-80097 is a clean demonstration that a verification step can run exactly as coded and still protect nothing, because it verified the claim instead of the caller. The fix on the defender side is a habit, not a patch: bind every token decision to the identity of the caller that the platform itself reports, never to a name the caller supplies.
The second lesson is about the installed app next door. The attack needed no permissions and no exploit chain. It needed one unvetted app on the same phone as a work account, plus a broker willing to trust it. That is why Microsoft guidance pairs the update with device management: require the fixed version, and know which apps share a device with your work accounts.
Answer six questions about your own phone and work setup. Everything runs in your browser; nothing is sent anywhere. The verdict shows its reasoning for every answer and lists the fix for each weak one, in the order Microsoft's guidance uses: update first, then enforcement, then the app inventory, then sessions.
To check your Authenticator version for question 2: open Authenticator, open the menu or About screen, and read the version listed there. Fixed is 6.2606.4246 or later. In the Play Store, open the Microsoft Authenticator listing; an Update button means your installed version is behind.
Agent Auth Gateway, Ingenious AI's gateway for application and agent identities, exists for the failure this flaw demonstrated: a broker that hands out tokens on the strength of a claimed identity. It verifies the caller itself, holds identities behind allowlists, budgets, and a kill switch, so a token decision never rests on a name the caller supplied. See Agent Auth Gateway.
One vendor, one security posture. Every platform below is live now on getingeniousai.com.
CVE-2026-80097 is a flaw in Microsoft Authenticator for Android, assigned on September 8, 2026 and rated 8.6 (Important) by Microsoft. On Android, Authenticator also works as a sign-in broker: apps such as Teams and Outlook ask it for sign-in tokens. Authenticator exposed an activity, AccountChooserActivity, that any app on the device could start with no permissions. It built the token request from values the calling app supplied, including the identity the app claimed to be. A malicious app could claim to be Teams and receive Microsoft Graph tokens for the work account signed into Authenticator on that device. Microsoft fixed the flaw in the September 2026 Patch Tuesday; the fixed version is Authenticator for Android 6.2606.4246.
A signature check existed, but it verified the wrong identity. It looked up the real signature of the app being impersonated and confirmed the request matched it. Because Teams was genuinely installed on the device, its real signature was there to read, so the check passed. Authenticator could also see which app had actually made the request, the Enclave research found, but it did not use that to decide whether to hand over a token. The broker verified the claim instead of the caller.
They agree on the flaw and disagree on one point. Enclave reported that its proof of concept returned tokens without any user interaction, other than the presence of a signed-in account. Microsoft's advisory says exploitation requires installing a malicious app on the device and convincing the user to complete an authentication flow in Authenticator, and its CVSS score reflects user interaction. Microsoft also says the flaw has not been used in attacks, was not publicly disclosed before the fix, and is not listed in the CISA Known Exploited Vulnerabilities catalog as of October 26, 2026.
Update Microsoft Authenticator for Android to version 6.2606.4246 or later. To check your version, open Authenticator, open the menu or About screen, and read the version listed there; in the Play Store, an Update button on the Authenticator listing means you are behind. Organizations that manage Android devices can require that minimum version through device management. Review which apps are installed on any phone that holds a work account, and remove apps you do not recognize or need. Microsoft's advisory does not say whether updating revokes tokens a malicious app may already have obtained, so our recommendation, where compromise is a concern, is to revoke the account's sessions from the account security page.
Sources: The Hacker News, October 27, 2026 (Swati Khandelwal), reporting Microsoft's advisory for CVE-2026-80097 and the Enclave research; Enclave's technical write-up, published October 23, 2026, by Ofek Levin (the AccountChooserActivity mechanism, the signature check that verified the impersonated app, the Microsoft Graph token permissions returned in testing, and the no-user-interaction result); Microsoft's advisory for CVE-2026-80097 as quoted by The Hacker News (the 8.6 rating and Important label, the September 8, 2026 assignment, the September 2026 Patch Tuesday fix, version 6.2606.4246 as the fixed version, the user-interaction position, exploitation rated less likely, no exploitation in attacks, no public disclosure before the fix, and the absence from the CISA Known Exploited Vulnerabilities catalog as of October 26, 2026). The session-revocation step is this page's recommendation, stated because Microsoft's advisory does not say whether updating revokes tokens already obtained; it is not Microsoft's wording.