Microsoft Authenticator CVE-2026-80097: update Android now

The app your team uses to prove who they are could be tricked into proving it for someone else. Researchers at Enclave disclosed CVE-2026-80097, a Microsoft Authenticator for Android flaw they call AuthMask. A malicious app with zero declared permissions could ask Authenticator for Microsoft 365 tokens while pretending to be Teams, and get them. No password. No approval prompt. If your staff sign in to work accounts on Android phones, check their Authenticator version today.

What actually happened

Enclave published the full write-up on October 23. The key facts:

• The flaw. Authenticator acts as an identity broker on Android. It exposed an activity that other apps can launch. A caller could claim to be a trusted Microsoft app, such as Teams, and supply a redirect URI built from Teams' public signing data. Authenticator checked the URI but did not confirm the caller really was Teams.
• What came back. Plaintext access, refresh and ID tokens. Impersonating Teams against Microsoft Graph returned delegated scopes including Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite and Sites.ReadWrite.All. Impersonating Authenticator itself returned scopes to change sign-in methods and create or delete passkeys.
• Preconditions. Authenticator installed, one work account signed in, and a malicious app on the same phone. The attacking app needed no permissions.
• Severity and fix. CVSS 8.6 (CWE-287, improper authentication). Microsoft fixed it in Authenticator for Android 6.2606.4246. The CVE was published September 8; Enclave held its details until October 23.

Cyber Security News picked up the disclosure today. We found no report of exploitation in the wild.

Why it matters for your business

Small teams run Microsoft 365 on personal Android phones all the time. No MDM, no app inventory, and an Authenticator that updates whenever the phone feels like it. That is the exact setup this bug punishes. A refresh token for Mail.Send and Files.ReadWrite.All is enough to send invoices from your CFO's mailbox and edit the files in SharePoint.

Do this before Friday:

1. Check the version. On each Android phone with a work account: Play Store, Microsoft Authenticator, confirm 6.2606.4246 or later. If you have Intune or another MDM, set a minimum app version.
2. Restrict sideloading. The attack needs a hostile app on the device. Block installs from unknown sources on work phones.
3. Review recent Graph sign-ins. In Entra ID sign-in logs, look for token use from unfamiliar IPs on Teams or Authenticator client IDs. Revoke sessions for anything odd.
4. Shorten token life where you can. Conditional Access sign-in frequency limits how long a stolen refresh token works.

Sources: Enclave: AuthMask, Cyber Security News.