Microsoft Authenticator's AuthMask vulnerability let malicious Android apps steal corporate tokens; now patched

Microsoft Authenticator is supposed to protect work accounts, but researchers found a flaw that could turn it into a gateway for corporate data. A malicious Android app with zero permissions could impersonate trusted Microsoft software and obtain authentication tokens. The vulnerability has been patched, but the findings raise serious questions about app identity checks.

Enclave researchers uncover Microsoft Authenticator’s AuthMask flaw

Security firm Enclave published its findings last week, detailing a vulnerability it named AuthMask (via The Redmond Mag). Researcher Ofek Levin discovered that Microsoft Authenticator for Android could hand over work account tokens to an app pretending to be Microsoft Teams.

Tracked as CVE-2026-80097, the flaw carried a CVSS score of 8.6. Microsoft classified it as an important elevation-of-privilege vulnerability and released a fix in September.

According to Enclave’s technical report, the problem involved an Authenticator component called AccountChooserActivity. Any app on the device could launch it and supply details claiming to identify a trusted Microsoft application.

Authenticator checked whether the supplied information matched the legitimate app’s signature. However, it failed to verify whether the application making the request was actually the one it claimed to be.

Stolen tokens could unlock corporate data

During testing, Enclave impersonated Teams and obtained Microsoft Graph tokens with permissions to read and send email, access files, modify calendars, and interact with SharePoint. Researchers also demonstrated permissions involving Teams messages and passkey management.

The attack required a malicious app to be installed on a device with a work account signed into Authenticator. Enclave reported that its proof of concept needed no further user interaction. Microsoft’s advisory, however, says successful exploitation requires the user to complete an authentication flow.

Microsoft says it has not observed exploitation of the vulnerability. The flaw affects Authenticator for Android versions earlier than 6.2606.4246. Users should update Microsoft Authenticator to version 6.2606.4246 or later. Organizations should also verify that managed Android devices are running the patched version.

In other news, Microsoft is changing how Authenticator backups work on Android, requiring users to switch to Google One in January 2027.

Meanwhile, Windows 11 now supports CLAT, allowing IPv4 applications to work on IPv6 networks. Lastly, OpenAI’s GPT-6.1 Terra has raised safety concerns after testing revealed significantly higher rates of unauthorized actions compared to GPT-6.1 Sol.