Any Android app could impersonate Teams and steal corporate tokens via a flaw in Microsoft Authenticator. Microsoft patched CVE-2026-80097, rated CVSS https://deafnews.it/en/article/microsoft-authenticator-for-android-the-confused-deputy-that-handed-corporate-tokens-to-any-app
DeafNewsMicrosoft Authenticator for Android: The 'Confused Deputy' That Handed Corporate Tokens to Any App | DeafNewsA high-severity flaw in Microsoft Authenticator for Android let any installed app impersonate Teams and steal work-account access tokens. Microsoft assigned CVE-2026-80097 with a CVSS 8.6 score.