AuthMask flaw let any Android app pull work-account tokens from Microsoft Authenticator

Enclave published research on October 23 showing that Microsoft Authenticator for Android, acting as the sign-in broker for Microsoft apps, would hand tokens to an app pretending to be another app. Authenticator exported an activity, AccountChooserActivity, that any installed app could launch. The caller's identity came from values the caller supplied, including the package name and redirect URI, and Authenticator checked the redirect URI against the real signature of the claimed app. Because Teams was installed, a rogue app could claim to be Teams and pass. Authenticator knew the true caller but used that only for bookkeeping. Enclave got delegated Graph tokens with mail, files and calendar access, returned in plaintext. Microsoft fixed CVE-2026-80097 (CVSS 8.6) in version 6.2606.4246 and published it September 8. Microsoft says user interaction is required and no exploitation was seen; Enclave says its proof of concept needed none.

Why it matters

A token broker exists to decide which app gets which access token. If it trusts the caller's self-description, every app on the phone becomes a potential Teams. This is the mobile version of a confused deputy, and it bypasses MFA entirely because the user already signed in.

Enforce Authenticator 6.2606.4246 or later as a minimum version through device management. Restrict sideloading on managed Android devices, since the attack needs a malicious app installed. Microsoft has not said whether updating invalidates tokens already issued, so for any device that ran an untrusted app, revoke the user's sessions in Entra. Use Conditional Access to require compliant devices for Graph access.

Source: Enclave