Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097) ยท updates https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later. en Tue, 27 Oct 2026 00:00:00 GMT Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097): Help Net Security reports the flaw and tells Android users to update to 6.2606.4246 or later. https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097#2026-10-27-ab694469 Tue, 27 Oct 2026 00:00:00 GMT high <p><a href="https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/">Source</a></p> Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097): Enclave publishes the AuthMask write-up showing a zero-permission app getting Teams' tokens from the Authenticator broker. https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097#2026-10-23-6a64dcb7 Fri, 23 Oct 2026 00:00:00 GMT high <p><a href="https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens">Source</a></p> Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097): Microsoft publishes CVE-2026-80097 (Microsoft Authenticator Elevation of Privilege, CVSS 8.6) with a fixed Android release. https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097#2026-09-08-3813d112 Tue, 08 Sep 2026 00:00:00 GMT high <p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097">Source</a></p>