Microsoft Authenticator Flaw Scores 8.6: Android Users Must Update

A high-severity flaw in Microsoft Authenticator could allow a malicious Android app to steal work account authentication tokens, potentially exposing corporate emails, files, and other sensitive information.

The vulnerability, tracked as CVE-2026-80097, carries a CVSS score of 8.6 and affects Microsoft Authenticator for Android versions earlier than 6.2606.4246. Security researchers demonstrated how a malicious Android application could impersonate an installed Microsoft app and obtain authentication tokens associated with a signed-in work account.

Microsoft has already patched the flaw, but Android devices running outdated versions could remain vulnerable. The findings highlight how attackers could exploit weaknesses in authentication software to gain access to corporate resources, even when multifactor authentication (MFA) is enabled.

Microsoft Authenticator flaw exposes work account tokens

Security researcher Ofek Levin detailed the vulnerability in an Enclave research report published Oct. 23.

The attack, dubbed AuthMask, exploited a weakness in Microsoft Authenticator's identity broker, which handles authentication requests from other applications. Researchers discovered that an Android application with no declared permissions could impersonate an installed Microsoft application, such as Teams, and request authentication tokens associated with a signed-in work account.

The vulnerability stemmed from improper authentication of the requesting application. Instead of reliably verifying which application initiated the request, Authenticator trusted identity information supplied within the request itself. This allowed an untrusted application to present itself as a legitimate Microsoft service.

According to Enclave, successful exploitation in its testing required an Android device with Microsoft Authenticator installed and a work account signed in. Researchers reported obtaining tokens without additional user interaction.

Microsoft's published CVSS assessment, however, lists user interaction as required. The available documentation does not explain the difference between Microsoft's assessment and Enclave's findings.

The vulnerability, documented in Microsoft's security advisory, carries a CVSS score of 8.6 and is categorized as CWE-287, Improper Authentication.

How the vulnerability could expose Microsoft 365 accounts

The attack targeted an exported Android activity called com.microsoft.identity.client.AccountChooserActivity.

Android applications can expose activities that other applications are permitted to launch. In this case, the affected activity processed authentication requests that included information about the purported calling application.

Researchers found that several important identity fields could be controlled by the requesting app, including its claimed package name, client ID, redirect URI, and user identifier.

Although Authenticator performed a signature-related validation check, that process relied on the application identity claimed in the request.

In the researchers' tests, a malicious application impersonated an installed Microsoft app and passed the validation check because Authenticator verified the claimed application's identity rather than the actual caller.

Once the request succeeded, Authenticator could return authentication information to the malicious application.

The researchers demonstrated that the returned data could include:

• Access tokens: Credentials that authorize access to specific services and resources.
• Refresh tokens: Credentials that may allow applications to obtain additional access tokens.
• ID tokens: Authentication information identifying the signed-in user.
• Client information: Details associated with the authenticated account and application.

The potential consequences extended beyond Microsoft Authenticator itself.

By impersonating Microsoft Teams, researchers obtained delegated permissions associated with Microsoft Graph, the API used to access Microsoft 365 services.

Those permissions included Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite, ChatMessage.Send, and Sites.ReadWrite.All.

These permissions could enable access to email, files, calendars, and certain Teams and SharePoint operations associated with the affected work account, subject to the permissions granted and applicable access controls.

Researchers also obtained authentication-management permissions, including UserAuthenticationMethod.ReadWrite, Passkey.Create, and Passkey.Delete, by impersonating Microsoft Authenticator's own client.

These permissions raise the risk of unauthorized changes to authentication methods. However, the published research does not demonstrate that researchers successfully created or deleted passkeys or established persistent account access.

Importantly, the stolen tokens would provide access to resources associated with the affected work account, subject to the permissions available to the impersonated application. The attack would not automatically expose every Microsoft account associated with the device's owner.

The findings demonstrate how a weakness in a mobile authentication broker could expose sensitive enterprise resources even when users have enabled MFA.

Which Android devices are affected?

The vulnerability affects Microsoft Authenticator for Android versions 6.0.0 up to, but not including, 6.2606.4246.

Microsoft published its security advisory on Sept. 8, 2026, and released a fix for the vulnerability. Enclave subsequently disclosed the technical details of the AuthMask attack on Oct. 23.

The following summarizes the affected environment and remediation information.

The attack requires a malicious application to be installed and executed on the affected Android device. It does not allow attackers to steal tokens remotely without first establishing that foothold.

However, the lack of an Android permission requirement is significant.

Applications ordinarily request access to sensitive device capabilities, potentially giving users and administrators an opportunity to identify suspicious behavior. In this case, the researchers demonstrated that a malicious application could exploit a vulnerability in the authentication process without requesting those permissions.

Has the Microsoft Authenticator flaw been exploited?

Enclave demonstrated that CVE-2026-80097 could be exploited under controlled testing conditions. However, its published research does not identify confirmed real-world attacks.

That does not establish that exploitation has never occurred. Organizations running vulnerable versions should still prioritize updating Microsoft Authenticator.

What Microsoft Authenticator users should do now

Although Microsoft has patched CVE-2026-80097, organizations should verify that employees using Android devices have installed a corrected version.

Devices that have not received the update could remain vulnerable, particularly in environments where employees access Microsoft 365 through personally owned or inconsistently managed smartphones.

Security teams should prioritize the following actions:

1. Update Microsoft Authenticator. Install the latest available version through Google Play and confirm that the installed version is 6.2606.4246 or later.
2. Audit managed Android devices. Use mobile device management tools to identify outdated installations and confirm that security updates have been deployed.
3. Review application installation policies. Restrict untrusted application sources where appropriate and investigate suspicious applications installed on corporate devices.
4. Monitor Microsoft 365 activity. Review Microsoft Entra sign-in records, relevant Microsoft Graph activity, and unexpected changes to authentication methods for signs of suspicious account access.
5. Investigate suspected compromise. If there is evidence of token theft, follow the organization's incident response procedures, including appropriate session or token revocation, a review of the authentication method, and device remediation.
6. Strengthen mobile access controls. Consider device compliance requirements and Conditional Access policies to reduce exposure from unmanaged or compromised endpoints.

Organizations should also recognize that installing the update addresses the vulnerability but does not necessarily invalidate authentication tokens that may have been stolen before remediation.

Where compromise is suspected, security teams should investigate potentially exposed sessions and credentials rather than relying exclusively on the application update.

Why this flaw matters for enterprise security

CVE-2026-80097 illustrates a broader risk involving applications that manage authentication on behalf of other software.

Microsoft Authenticator is designed to help organizations protect accounts, but its role as an authentication broker also makes it a sensitive component of enterprise identity infrastructure. When an authentication broker fails to verify the identity of an application requesting credentials, an attacker may exploit an otherwise legitimate authentication process.

The AuthMask research demonstrates how that weakness could expose corporate resources without requiring an employee to disclose a password. Malicious software on an affected Android device could threaten an authenticated work account by obtaining tokens through the vulnerable authentication process.

For security administrators, the immediate priority is to verify that affected Android devices are up to date and to investigate any indications of suspicious account activity. The larger lesson is that MFA remains an important security control, but protecting the applications and devices that handle authentication tokens is equally critical.

Organizations that overlook mobile application updates could leave sensitive Microsoft 365 resources exposed even when employees follow established account security practices.

For more on how attackers can compromise Microsoft 365 accounts despite MFA protections, read our coverage of BigBear 2.0, which stole authenticated sessions at 258 organizations.