---
title: AuthMask: a zero-permission Android app could pose as Teams and get Microsoft Authenticator to hand it work-account tokens for mail, files and calendar (CVE-2026-80097, patched) | ctxsec
url: https://ctxsec.com/items/authmask-microsoft-authenticator-android-cve-2026-80097-token-theft
description: ""
status: "patched (MSRC CVE-2026-80097, CVSS 8.6; fixed in 6.2606.4246); write-up by Enclave Oct 23; Microsoft lists no exploitation"
published: 2026-10-26
---

> 

[← Cybersecurity News](/news) · [markdown](/items/authmask-microsoft-authenticator-android-cve-2026-80097-token-theft.md)

patched (MSRC CVE-2026-80097, CVSS 8.6; fixed in 6.2606.4246); write-up by Enclave Oct 23; Microsoft lists no exploitation

2026-10-26

### AuthMask: a zero-permission Android app could pose as Teams and get Microsoft Authenticator to hand it work-account tokens for mail, files and calendar (CVE-2026-80097, patched)

Enclave found that Authenticator for Android exported `com.microsoft.identity.client.AccountChooserActivity` to any app and built broker requests entirely from caller-supplied fields (package, UID, client ID, redirect URI, scopes). Its signature check compared the claimed app's redirect URI with that same app's installed signature, so it always passed and never checked who was really calling. In Enclave's tests a malicious app with no permissions got Microsoft Graph tokens for the signed-in work account.

Microsoft rates it Important (CVSS 8.6), says it was not publicly disclosed or exploited when published on Sep 8, and lists Authenticator for Android versions **6.0.0 up to but not including 6.2606.4246** as affected.

**What to do:** check that managed Android devices run Authenticator 6.2606.4246 or later (enforce a minimum app version in Intune if you can), and treat sideloaded apps on devices with work accounts as a token-theft risk.

Sources: [MSRC: CVE-2026-80097, Microsoft Authenticator Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097) · [Enclave: AuthMask, we made Microsoft Authenticator hand over tokens to an app with zero permissions (Oct 23)](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens) · [CVE record: CVE-2026-80097](https://www.cve.org/CVERecord?id=CVE-2026-80097)