Microsoft Teams for Android: Spoofing due to origin validation error

Summary

An origin validation error in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over the network. According to the CVSS vector, no privileges and no user interaction are required, and the attack complexity is low. The CVSS vector also rates confidentiality impact as high, while Microsoft classifies the issue as spoofing; the exact impact has not been confirmed publicly.

Affected

• Microsoft Teams for Android from 1.0.0 before 1416/1.0.0.2026202302
• Source: CVE record (CNA: Microsoft)

Fixed in

• Build 1416/1.0.0.2026202302 is implied as the first fixed version by the CVE record; not confirmed on the MSRC advisory page. Verify in the MSRC advisory before compliance reporting.

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild (per one aggregator and Microsoft temporal vector E:U, Unproven)
• No public proof-of-concept found
• CISA SSVC: Exploitation none, automatable yes, technical impact partial
• NVD status: Awaiting Analysis

Our recommendation

• Inventory all Android devices with Microsoft Teams and their build numbers
• Update Teams for Android to build 1416/1.0.0.2026202302 or later (verify the build in the MSRC advisory first)
• Enforce app auto-update and confirm fixed builds via MDM or Google Play management
• Give priority to unmanaged (BYOD) phones that access company Teams data
• Recheck MSRC and NVD for changes to exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• CVE Record CVE-2026-69901 www.cve.org
• Strix CVE summary (secondary) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:13.