Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app such as Teams and collect signin tokens for a victims work account Microsoft tracks the flaw as CVE202680097 and fixed it in Authenticator for Android version 626064246 so anyone using the app should update In the researchers tests