CVE-2026-80097
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.6
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
- CWE
- CWE-287
- Published
- 2026-09-08
- Last modified
- 2026-09-09
Affected products
- Microsoft Microsoft Authenticator for Android
Weakness type
Related vulnerabilities
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-87806 — Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- CVE-2026-79974 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-80099 — Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
- CVE-2026-76009 — Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
- CVE-2026-78560 — Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source
- CVE-2026-86810 — Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication
- CVE-2026-86808 — moltis-org moltis vault.rs vault_recovery_handler missing authentication