Microsoft Authenticator Android MSAL broker caller-identity bypass via exported AccountChooserActivity

CVE-2026-80097 is an improper-authentication flaw in Microsoft Authenticator for Android (all versions before 6.2606.4246). The app's MSAL broker exposes an Android activity — com.microsoft.identity.client.AccountChooserActivity — marked android:exported="true". Any app on the same device can launch it via startActivityForResult and supply intent extras (broker_request_v2 JSON) that spoof the caller's package name, client ID, redirect URI, scopes, and UID. Authenticator's only validation compared the *attacker-supplied* redirect URI against the *legitimate package's* computed URI — which any app can derive from PackageManager — rather than using Android's built-in getCallingActivity() to verify who was actually calling. The result: the broker returns plaintext access tokens, refresh tokens, and ID tokens granting delegated Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite, ChatMessage.Send, and Sites.ReadWrite.All scopes. Impersonating Authenticator itself even yields UserAuthenticationMethod.ReadWrite, enabling passkey manipulation.

Microsoft rates this HIGH at 8.6, and the base CVSS math is technically correct for AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. However, that score overlooks the real-world delivery barrier: the attacker must first land a malicious app on the target's Android device. In enterprise environments with Intune-managed Google Play, sideloading restrictions, and Play Protect enforcement, installing an untrusted APK is significantly harder than the CVSS AC:L implies. The per-device, per-user blast radius also means there is no single-exploitation fleet-wide outcome — each phone must be individually compromised. The vendor's 8.6 is defensible for unmanaged BYOD fleets but overstates the risk for MDM-enrolled estates. We downgrade the numeric score to 7.0 while keeping the HIGH bucket because the affected component is an identity broker and the post-exploitation impact on any single compromised user is severe.

Sources.

1. MSRC Advisory CVE-2026-80097
2. Enclave — AuthMask: We Made Microsoft Authenticator Hand Over Tokens
3. Help Net Security — Microsoft Authenticator vulnerability
4. GBHackers — Microsoft Authenticator Flaw Allows Zero-Permission Token Theft
5. CyberPress — Microsoft Authenticator Flaw Lets Malicious Apps Steal Tokens
6. TheCyberSecGuru — CVE-2026-80097 Broker Bypass Analysis
7. BetaNews — Microsoft patches high severity flaw in Authenticator

Run on an auditor workstation with adb in PATH and the target Android device connected via USB with USB debugging enabled. Requires no root on the device. Usage: bash check_cve_2026_80097.sh — checks the connected device and exits 0 (PATCHED), 1 (VULNERABLE), or 2 (UNKNOWN).

#!/usr/bin/env bash
# CVE-2026-80097 Verification — Microsoft Authenticator Android version check
# Target: connected Android device via ADB
# Output: VULNERABLE / PATCHED / UNKNOWN
set -euo pipefail

PACKAGE="com.azure.authenticator"
FIXED_MAJOR=6
FIXED_MINOR=2606
FIXED_PATCH=4246

if ! command -v adb &>/dev/null; then
  echo "UNKNOWN — adb not found in PATH"
  exit 2
fi

if ! adb get-state &>/dev/null 2>&1; then
  echo "UNKNOWN — no Android device connected via ADB"
  exit 2
fi

VERSION=$(adb shell dumpsys package "$PACKAGE" 2>/dev/null \
  | grep -m1 'versionName=' | sed 's/.*versionName=//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Microsoft Authenticator ($PACKAGE) not installed"
  exit 2
fi

IFS='.' read -r V_MAJOR V_MINOR V_PATCH <<< "$VERSION"
V_MAJOR=${V_MAJOR:-0}; V_MINOR=${V_MINOR:-0}; V_PATCH=${V_PATCH:-0}

echo "Installed: $VERSION  |  Fixed: ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"

if (( V_MAJOR > FIXED_MAJOR )) \
   || (( V_MAJOR == FIXED_MAJOR && V_MINOR > FIXED_MINOR )) \
   || (( V_MAJOR == FIXED_MAJOR && V_MINOR == FIXED_MINOR && V_PATCH >= FIXED_PATCH )); then
  echo "PATCHED — CVE-2026-80097 is fixed in $VERSION"
  exit 0
else
  echo "VULNERABLE — CVE-2026-80097 affects Microsoft Authenticator < ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"
  exit 1
fi