Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097)
Microsoft Authenticator for Android
Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later.
Why this severity: Microsoft CVSS 8.6 (Important); needs a malicious app on the device, Microsoft says not exploited
- Started
- Oct 23, 2026
Affected
- Microsoft Authenticator for Android 6.0.0 to before 6.2606.4246
Fixed in
- Microsoft Authenticator for Android 6.2606.4246
Timeline3
Help Net Security reports the flaw and tells Android users to update to 6.2606.4246 or later.
Enclave publishes the AuthMask write-up showing a zero-permission app getting Teams' tokens from the Authenticator broker.
Microsoft publishes CVE-2026-80097 (Microsoft Authenticator Elevation of Privilege, CVSS 8.6) with a fixed Android release.
Advisories2
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
