Direct answer: A flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097 and nicknamed AuthMask, let a malicious app with no Android permissions pose as a trusted Microsoft app such as Teams and receive sign-in tokens for a work account. Microsoft fixed it in Authenticator for Android version 6.2606.4246. If you use Authenticator on Android, update to that version or later and check that any managed devices are on it too.
The story matters because Authenticator is not just a code generator for many people. On Android it also acts as a sign-in broker for Microsoft apps, so a flaw in that broker can reach far beyond a single one-time code. Researchers disclosed the technical details on October 23, 2026, and Microsoft had already published the CVE on September 8, 2026, rating it 8.6 out of 10 and Important. As of October 26, 2026, it was not listed in the US CISA Known Exploited Vulnerabilities catalog, and Microsoft said it had found no evidence of real-world exploitation.
What AuthMask actually did
When you open Teams, Outlook, or another Microsoft app on Android and sign in, that app often asks Authenticator to handle the sign-in. Authenticator checks the request, then hands back tokens that prove the user is signed in. Those tokens are the keys to the account: an access token for the current session, a refresh token that can fetch new access tokens, and an ID token identifying the user.
Enclave researcher Ofek Levin, working through the Enclave Fellowship Program, found that Authenticator exposed an activity called AccountChooserActivity that any installed app could start, even an app holding no permissions at all. The attacking app could then fill in the request itself: the package name it claimed to be, a client ID, a redirect URI, and the permissions it wanted. In the tests, the app claimed to be Teams.
That is where the check failed. Authenticator validated the redirect URI against the signature of the app being impersonated, not against the app actually making the request. Because Teams was genuinely installed on the device, its real signature was available to read, so the check passed. Authenticator could also see which app had really launched the activity, but it did not use that information to decide whether to hand over a token. It trusted the claimed identity instead of the real caller.
What an attacker could reach
In Enclave’s tests, impersonating Teams and requesting Microsoft Graph tokens returned broad delegated permissions: reading and writing mail, sending mail, reading and writing files, reading and writing calendars, sending chat messages, and reading and writing SharePoint sites, among others. Impersonating other Microsoft clients produced different sets of permissions, including, in one case, passkey-related permissions.
Put simply, the tokens did not just prove a sign-in happened. They carried the same kind of access the real Teams app would have had to that work account’s mailbox, files, and calendar. That is why the flaw is rated high even though it is a local attack: the attacker still needed a malicious app installed on the phone, but that app needed no permissions, which makes it far easier to hide.
There is one point where the researcher and Microsoft describe the attack differently, and readers should know about it. Enclave reported that its proof of concept returned tokens without user interaction beyond having a signed-in account present. Microsoft’s advisory says exploitation requires installing a malicious app and convincing the user to complete an authentication flow in Authenticator, and its CVSS score reflects that user interaction is required. The practical advice is the same either way: update, and be cautious about apps you install and sign-in prompts you approve.
Who was affected
Versions of Microsoft Authenticator for Android before 6.2606.4246 were affected. The flaw applied to the work account signed into Authenticator on that device, not to other accounts on the phone. It did not affect the iOS version of Authenticator, which uses a different broker implementation, and it did not require the attacker to know the user’s password.
Organizations are the most exposed group here, because work accounts often hold email, OneDrive files, SharePoint content, and Teams conversations. Personal Microsoft accounts that rely on Authenticator only for two-factor codes are in a different position, but the same advice applies: keep the app updated, since the broker role is what made this flaw serious.
How to check and update Authenticator on Android
Open the Google Play Store, search for Microsoft Authenticator, and open its store page. If an Update button is shown, install it. Then open Authenticator, go to Settings, and confirm the version is 6.2606.4246 or later. On managed devices, IT administrators can require that minimum version through their device management tools, which is the reliable way to cover a whole workforce rather than relying on each person to update by hand.
Updating fixes the flaw going forward. One gap in the public record is worth noting honestly: Microsoft’s advisory gives the fix but does not say whether updating cancels any token a malicious app may already have obtained. If you have reason to think a suspicious app was on a device, the safe steps are to remove that app, review recent sign-ins and sessions for the work account, revoke unfamiliar sessions, and ask your IT team to check for unusual mailbox or file activity.
What this means for how you judge sign-in apps
The lesson of AuthMask is not that Authenticator is untrustworthy. It is that a sign-in broker has one job above all others: knowing exactly who is asking. A broker that checks the identity a caller claims, without checking the caller itself, has missed the central question. Microsoft confirmed the issue, fixed it, and published the CVE, which is how responsible disclosure is supposed to work.
For users, the takeaway is practical rather than technical. Keep Authenticator updated, install Android apps only from sources you trust, and treat unexpected sign-in prompts with suspicion, even when they look like they come from a familiar Microsoft app. For IT teams, the takeaway is to treat the minimum Authenticator version as a compliance check, just like an operating system patch level, and to review app inventories on devices that hold work accounts.
Related reading on TechToRev: the Apple zero-day patched in October 2026 shows the same pattern of a quiet fix with a clear user action; the Google certificate hijack is another case where a trusted check was bypassed; and Anthropic Cyber Mission covers the wider push to use AI for defensive security scanning.
Frequently asked questions
What is the Microsoft Authenticator AuthMask flaw?
AuthMask is the name researchers gave to CVE-2026-80097, a flaw in Microsoft Authenticator for Android. A malicious app with no permissions could pose as a trusted Microsoft app such as Teams and receive that app’s work account tokens from Authenticator’s sign-in broker.
Which Authenticator version fixes CVE-2026-80097?
Microsoft Authenticator for Android version 6.2606.4246 or later. Versions before that release are affected. Update through the Google Play Store and confirm the version in the app’s Settings.
Was the Authenticator flaw exploited in the real world?
Microsoft said it had found no evidence of exploitation, rated exploitation as less likely, and the flaw was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. The risk was demonstrated in researcher tests, not in confirmed attacks.
Does the flaw affect iPhones or personal Microsoft accounts?
The flaw was in the Android version of Authenticator and affected the work account signed into Authenticator on that device. It did not apply to other accounts on the same phone, and the iOS app was not the subject of this advisory.
What should I do if I think a malicious app was on my phone?
Remove the suspicious app, update Authenticator, review recent sign-ins and active sessions for the work account, revoke anything unfamiliar, and report it to your IT team so they can check for unusual mailbox, file, or calendar activity.