Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft fixed a flaw in Authenticator for Android, tracked as CVE-2026-80097 and rated 8.6 on the CVSS scale, that let a permissionless malicious app pose as Teams and obtain sign-in tokens for a victim's work account. Enclave researcher Ofek Levin found...