Microsoft Authenticator flaw let any Android app steal work account access

The flaw

Microsoft Authenticator is used by millions of people to sign in to work accounts. On 27 October 2026, researchers disclosed CVE-2026-80097, a vulnerability in the Android version that let any app on the device silently steal work account access ^[1].

The flaw meant a rogue app could take over the session without triggering a permission prompt, a warning or any visible sign. The user didn't need to do anything. The app just needed to be there.

Microsoft has patched the vulnerability ^[1].

Why it matters

Vulnerabilities like this are patched and forgotten, until someone asks an awkward question months later. Say an employee's device was used to transfer funds or delete records, and the question is whether the device was compromised at the time.

The organisation needs to show what was on the device. The employee needs to show what wasn't. Neither side usually has a log.

Device management systems often record when an app was installed, but not when it ran, and mobile operating systems don't keep detailed logs of every app launch unless the device is being monitored in real time. By the time someone asks, the trail is cold.

It's a bit like asking what was in the fridge a year ago. You might remember putting the milk in, but you can't prove the broccoli wasn't there unless you took a photo at the time.

The evidence gap

Incident response teams face this all the time. When a device is suspected of being compromised, the first questions are: which apps were on it, when were they installed, and when did they run?

The answers are rarely in the logs. Android's own logging is limited and ephemeral. Enterprise device management can track app installs, but not every launch. Forensic tools can sometimes recover deleted app data, but they can't tell you what wasn't there.

The result is that the organisation can't prove the device was clean, and the employee can't prove it was compromised. The dispute turns on what each side says happened, not on what can be shown.

What this means for you

If your organisation lets people use their own devices for work, or manages a fleet of corporate devices, here are three questions worth asking now:

1. Could you show which apps were installed on a given device on a given day?
2. If an employee claims a rogue app stole their credentials, could you check that claim against a log?
3. If you needed to show a device was clean at a particular time, what record would you point to?

Patching vulnerabilities is the foundation. Knowing what was on a device, and being able to prove it later, is the next step.

How a digital witness would work here

The thing to seal is a snapshot of installed apps at regular intervals: package names, install dates and versions. You'd seal it on the device, for example once a day, or whenever a new app is installed.

The snapshot itself stays on the device. Only a fingerprint is sealed with WitniumChain, through the REST API or the SDK. To check, you calculate the fingerprint again and compare it with the sealed one.

What it shows is that a snapshot from a particular day hasn't changed since it was sealed. If an app appears in a later snapshot but not in an earlier one, you can show when it arrived. If someone claims an app was there all along, the sealed snapshots settle it.

What it doesn't do is tell you whether an app is malicious, or prove that an app launched. It just gives you a checkable record of what was installed, and when.

How it would work

1. The device takes a snapshot of installed apps once a day, or when a new app is installed.
2. A fingerprint of the snapshot is sealed immediately.
3. When a device is questioned, anyone you share the snapshot with can check that it matches the sealed fingerprint.

The first 2,000 witnesses a month are free. The content stays with you. Read more in the documentation.

What to watch

Vulnerabilities in authentication apps are rare, but not unheard of. When they happen, the evidence question is the same: could you show what was on a device at the time?

For organisations in sectors covered by DORA, the Cybersecurity Act or NIS2, incident response already means tight deadlines for reporting. The Cybersecurity Act asks for an early warning within 24 hours of becoming aware of an incident ^[2]. Knowing what ran where, and being able to show it, makes that reporting faster and more credible.

Microsoft's patch closes this particular door. The broader question stays open.