Any Android App Could Ask Microsoft Authenticator for Your Work Tokens
Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited.
A flaw in Microsoft Authenticator for Android let an app with no special permissions get work-account tokens by pretending to be another Microsoft app, such as Teams. Enclave, which calls the bug AuthMask, published details on Oct. 23. Microsoft fixed it in September as CVE-2026-80097 and says it hasn’t seen it exploited, The Hacker News reports.
For defenders
The bug: On Android, Authenticator also acts as the sign-in broker that hands tokens to Outlook, Teams and other Microsoft apps. Enclave found that one of its screens could be opened by any app on the device, and that Authenticator trusted the caller’s claim about which app it was instead of checking who actually asked. The result is T1528 (Steal Application Access Token): Microsoft Graph tokens for the signed-in work account. In Enclave’s tests those covered reading and sending mail, reading and writing files and calendars, and posting Teams messages.
Status: CVSS 8.6 (Microsoft rates it Important). Microsoft says it wasn’t exploited or publicly disclosed before the fix and rates exploitation “less likely.” It isn’t in CISA’s KEV catalog. Proof-of-concept code is reported in one GitHub repository. Fixed in Authenticator for Android 6.2606.4246.
Disputed: Enclave says its proof of concept needed no user interaction beyond a signed-in work account. Microsoft says the victim has to install a malicious app and complete a sign-in flow. Either way, the attacker needs an app on the phone first. Microsoft’s advisory doesn’t say whether updating cancels tokens an app may already have taken.
What it means for you
If you use Microsoft Authenticator on an Android phone for work, a sketchy app on that same phone could have quietly gotten into your work email and files. There’s no sign of anyone doing that, and the fix has been out since September. Just make sure the app is updated. iPhone users aren’t affected.
Do this now
- Update Microsoft Authenticator from the Google Play Store and check that it’s version 6.2606.4246 or later.
- IT teams: set that as the minimum Authenticator version in Intune or your mobile device management tool.
- Remove apps you don’t recognize from work phones, and block installs from outside the Play Store.
- If a device had an untrusted app installed, revoke that user’s sessions in Entra so any old tokens stop working.
CVE at a glance
- CVSS
- 8.6 High (v3.1)
- EPSS
- 0.5% chance of exploitation in the next 30 days (higher than 44.9% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 1 GitHub repository
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.