# Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097) · pwn.watch > Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later. Page: https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 · generated 2026-10-27T08:16:37.365Z ## Status - Severity: high · status: live · patch: patched - Product: Microsoft Authenticator for Android - Started: 2026-10-23 - CVEs: CVE-2026-80097 - Affected: Microsoft Authenticator for Android 6.0.0 to before 6.2606.4246 - Fixed in: Microsoft Authenticator for Android 6.2606.4246 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097/feed.xml - JSON Feed: https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097.json - This file: https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097/llms.txt ## Updates (newest first) - 2026-10-27: Help Net Security reports the flaw and tells Android users to update to 6.2606.4246 or later. (https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/) - 2026-10-23: Enclave publishes the AuthMask write-up showing a zero-permission app getting Teams' tokens from the Authenticator broker. (https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens) - 2026-09-08: Microsoft publishes CVE-2026-80097 (Microsoft Authenticator Elevation of Privilege, CVSS 8.6) with a fixed Android release. (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097) ## Fix brief # Security brief: Microsoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097) Source: https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097 · status: live · severity: high · updated Oct 27, 2026, 06:26 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later. Severity detail: Microsoft CVSS 8.6 (Important); needs a malicious app on the device, Microsoft says not exploited - Product: Microsoft Authenticator for Android - CVE / advisory ids: CVE-2026-80097 ## Affected versions - Microsoft Authenticator for Android 6.0.0 to before 6.2606.4246 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Microsoft Authenticator for Android 6.2606.4246 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Update Microsoft Authenticator from Google Play and check it is 6.2606.4246 or later. If you manage company devices, enforce that minimum version through MDM. Avoid sideloading or installing unfamiliar apps on phones with a work account in Authenticator. If a device may have had a malicious app, review the account's sign-in methods and passkeys for ones you didn't add. ## Latest updates - Oct 27, 2026: Help Net Security reports the flaw and tells Android users to update to 6.2606.4246 or later. - Oct 23, 2026: Enclave publishes the AuthMask write-up showing a zero-permission app getting Teams' tokens from the Authenticator broker. - Sep 8, 2026: Microsoft publishes CVE-2026-80097 (Microsoft Authenticator Elevation of Privilege, CVSS 8.6) with a fixed Android release. ## Advisories - [CVE-2026-80097: Microsoft Authenticator Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097) (Microsoft Security Response Center) - [CVE-2026-80097](https://nvd.nist.gov/vuln/detail/CVE-2026-80097) (NVD) ## Write-ups & news - [AuthMask: We Made Microsoft Authenticator Hand Over Tokens to an App With Zero Permissions](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens) - [Microsoft Authenticator vulnerability let rogue Android apps steal work account access](https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/) --- Machine-readable: https://pwn.watch/i/microsoft-authenticator-android-authmask-cve-2026-80097.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.