Security Digest · Oct 23, 2026 · Vulnerability · Identity
Microsoft Authenticator Android CVE-2026-80097 Token Theft
A zero-permission Android app could get work tokens from Microsoft Authenticator before 6.2606.4246. Fixed in September; not exploited. Check versions.
Our verdict
Most can relax
A serious design flaw with a public write-up, but it was fixed seven weeks ago and Microsoft reports no exploitation: confirm Android devices run Authenticator 6.2606.4246 or later and move on.
Who must act: Organizations whose staff sign in to Microsoft 365 work accounts through Microsoft Authenticator on Android devices that may not auto-update apps, such as unmanaged BYOD phones or devices with Play Store updates disabled.
Who can relax: iPhone users, Android devices already on Authenticator 6.2606.4246 or later, and personal Microsoft accounts with no work account added to the broker.
- Affected
- Microsoft Authenticator for Android 6.0.0 to before 6.2606.4246
- Fixed in
- Microsoft Authenticator for Android 6.2606.4246 (fix listed by Microsoft on Sep 8, 2026)
- CVSS
- 8.6 (v3.1, vendor)
- EPSS
- 0.5% (percentile 45)
- CISA KEV
- Not listed
- Exploitation
- No known exploitation
- Severity
- High
What to do
- Pull an app inventory from your MDM and find Android devices with Microsoft Authenticator below 6.2606.4246.
- Have users on old versions update Authenticator from Google Play, then confirm the version.
- For any device that ran an old version alongside sideloaded or untrusted apps, revoke the user's sessions in Entra ID (Revoke-MgUserSignInSession).
- Keep Android app auto-updates on for managed devices and block sideloading where you can.
How to check if you are affected or compromised
- Check the installed version: adb shell dumpsys package com.azure.authenticator | grep versionName, or the version list in your MDM.
- No indicators of compromise have been published; for a suspect user, review Entra ID sign-in and Microsoft Graph audit logs for mail, file or authentication-method changes the user did not make.
- Look for passkeys or authentication methods added to the account that the user does not recognize, since the researchers obtained tokens able to create and delete passkeys.
What happened#
On October 23, 2026, Ofek Levin of security firm Enclave published "AuthMask," a technical write-up of CVE-2026-80097 in Microsoft Authenticator for Android. Microsoft had already fixed the bug and published the CVE in its September 8 Patch Tuesday release. The CVE record lists versions 6.0.0 up to, but not including, 6.2606.4246 as affected.
On Android, Authenticator acts as a sign-in broker: other Microsoft apps such as Teams and Outlook ask it for tokens for the work account signed in on the device. Enclave found that the exported AccountChooserActivity checked only that a caller existed. It trusted the redirect URI and app identity that the caller supplied. A malicious app with no Android permissions could claim to be Teams. The signature check passed as long as the real Teams app was installed, because Authenticator looked up Teams' genuine signature. Authenticator read the real caller's package name but did not use it to decide whether to issue a token.
In Enclave's tests, the returned bundle included access, refresh and ID tokens in plaintext. Posing as Teams and requesting Microsoft Graph produced scopes including Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite and Sites.ReadWrite.All. Posing as Authenticator's own client produced UserAuthenticationMethod.ReadWrite, Passkey.Create and Passkey.Delete.
Who is affected#
Android devices running Authenticator below 6.2606.4246 with a work or school (Entra ID) account signed in. The tokens cover only the account in Authenticator on that device. The iOS app is not listed in the CVE record. An attacker needs a malicious app installed on the same phone. This is not a remote attack.
Do you really need to act?#
For most organizations, no more than a version check. Microsoft's advisory says the flaw was not publicly disclosed before the fix and has not been exploited, and it rates exploitation "less likely." The CVE is not in CISA KEV. Google Play updates apps automatically by default, and the fix shipped seven weeks before the write-up, so most phones already have it.
The two sides disagree on how easy exploitation is. Microsoft's FAQ says the attacker must install a malicious app and convince "the user to complete an authentication flow in Microsoft Authenticator." Its CVSS vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.6) also requires user interaction. Enclave says its proof of concept needed no interaction beyond a signed-in work account. Assume the worse case for any phone that still runs an old build. The impact there is serious: mail access, the ability to send mail as the user, and passkey changes would give an attacker persistence beyond a single token.
Neither Microsoft nor Enclave says whether updating the app revokes tokens that were already issued (The Hacker News). That matters only if a device ran a vulnerable build alongside an untrusted app.
What to do now#
- Export the app inventory from Intune or your MDM and filter for
com.azure.authenticatorbelow 6.2606.4246. - Get those devices updated from Google Play. On a test phone, check with
adb shell dumpsys package com.azure.authenticator | grep versionName. - If an outdated device also had sideloaded or untrusted apps, revoke the user's refresh tokens with
Revoke-MgUserSignInSession -UserId <upn>(Microsoft Graph PowerShell) and review their authentication methods. - Keep automatic app updates on for managed Android devices, and restrict installs from unknown sources.
How to tell if you were hit#
No indicators of compromise have been published, and there is no known in-the-wild use. For a user whose device was outdated and exposed to untrusted apps, review Entra ID sign-in logs and Microsoft Graph audit activity for mail sent, files changed or calendar edits the user did not make. Check the account's authentication methods for passkeys or other methods the user does not recognize. Remove any you find, then revoke sessions.
Timeline#
- — Microsoft reserves CVE-2026-80097.
- — Microsoft publishes the CVE in its September Patch Tuesday release, listing Authenticator 6.2606.4246 as the fixed version.
- — Enclave publishes the AuthMask technical write-up.
- — Wider press coverage. The CVE is still not in KEV, and no exploitation is reported.
Vulnerability records
- CVE-2026-80097 · Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Microsoft MSRC — CVE-2026-80097: Microsoft Authenticator Elevation of Privilege Vulnerability msrc.microsoft.com
- CVE record — CVE-2026-80097 cve.org
- Enclave — AuthMask: We made Microsoft Authenticator hand over tokens to an app with zero permissions enclave.ai