Threat reportVulnerabilityTL-2026-4431
Microsoft Authenticator for Android Flaw (CVE-2026-80097, AuthMask) Lets Malicious Apps Steal Account Tokens With Zero Permissions
Microsoft Authenticator for Android Flaw (CVE-2026-80097 (TL-2026-4431), also tracked as AuthMask, is a high-severity software vulnerability scored CVSS 8.6, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Microsoft Authenticator for Android, references 1 CVE (CVE-2026-80097), maps to 5 MITRE ATT&CK techniques (T1404, T1528, T1550.001), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4431
- Threat ID
- TL-2026-4431
- Also known as
- AuthMask
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, government administration, finance, health, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How Microsoft Authenticator for Android Flaw (CVE-2026-80097 works
CVE-2026-80097 (AuthMask) is a local elevation-of-privilege flaw (CWE-287, CVSS 8.6) in Microsoft Authenticator for Android caused by improper caller authentication in the exported broker activity com.microsoft.identity.client.AccountChooserActivity. Enclave researcher Ofek Levin showed a zero-permission malicious app can impersonate Microsoft apps such as Teams and obtain access, refresh and ID tokens without user approval; versions before 6.2606.4246 are affected and a fix has shipped.
Microsoft Authenticator for Android (com.azure.authenticator) includes a broker component that hands delegated tokens to trusted Microsoft apps on the device. The activity com.microsoft.identity.client.AccountChooserActivity runs in the :auth process and is marked android:exported="true", so any installed app can launch it without holding any Android permission.
Per Enclave's AuthMask write-up, the broker validated the caller identity claimed in the request rather than the identity of the actual calling app. Its signature check compared the claimed package's redirect URI against stored values. Because the attacker controls the request, the attacker can compute the legitimate redirect URI for the app they want to impersonate and pass the check. The caller's real package name, UID and signing certificate were not used to decide trust.
The attacker app sends an explicit intent whose extras include a broker_request_v2 JSON object (client_app_name, client_id, redirect_uri, scopes, authority, username), a spoofed caller.info.uid matching the target app, and common.broker.protocol.version.name set to 20.0. Enclave demonstrated impersonating Microsoft Teams (client ID 1fec8e78-bce4-4aaf-ab1b-5451cc387264) with Microsoft Graph scopes such as Mail.ReadWrite, Files.ReadWrite.All and Calendars.ReadWrite. It also demonstrated the Teams chat backend (api.spaces.skype.com, user_impersonation scope) and Authenticator's own client with UserAuthenticationMethod and Passkey management scopes. The broker returned access_token, refresh_token, id_token and client_info in plaintext through broker_result_v2_compressed. This worked on devices with a signed-in work account, with no consent prompt shown to the victim.
Stolen delegated tokens can reach Microsoft Graph resources such as mailboxes, calendars, OneDrive, SharePoint and Teams. The permissions to manage authentication methods and passkeys raise the risk of persistence on the account.
The CVE was published on 2026-09-08 with CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (8.6); Lutra's record also lists E:U/RL:O/RC:C. Affected versions are Authenticator for Android 6.0.0 up to but excluding 6.2606.4246; the fix shipped in July 2026 (month precision only). The vector carries UI:R, so the user must install or open the attacker's app. STAR Labs' Patch Tuesday tracker rates it Not Exploited / Less Likely with unproven exploit maturity, and the CVE is not in CISA KEV. No in-the-wild exploitation, named threat actor, or network IOCs are reported. Enclave's article includes inline code showing the attack chain, but no standalone downloadable PoC was identified.
Defender relevance: the risk is on unmanaged or BYOD Android devices carrying work accounts. Update Authenticator through Google Play, enforce minimum-app-version and compliance policies via Intune/MDM, restrict sideloading, and hunt Entra ID sign-in logs for unexpected token issuance to Microsoft first-party client IDs (for example Teams) from mobile devices on pre-fix Authenticator builds.
MITRE ATT&CK techniques used in TL-2026-4431
Privilege Escalation
T1404 Exploitation for Privilege Escalation
Credential Access
T1528 Steal Application Access Token; T1635 Steal Application Access Token
lateral-movement
T1550.001 Application Access Token
Lateral Movement
T1550.001 Application Access Token
Defense Evasion
Affected products and versions in Microsoft Authenticator for Android Flaw (CVE-2026-80097
- Microsoft — Microsoft Authenticator for Android
Vulnerable versions: 6.0.0 through versions prior to 6.2606.4246
Fixed in: 6.2606.4246
Remediation for Microsoft Authenticator for Android Flaw (CVE-2026-80097
Patches
- Microsoft Authenticator for Android 6.2606.4246 (released July 2026)
Immediate actions
- Update Microsoft Authenticator for Android to 6.2606.4246 or later via Google Play
- Verify managed Android devices run the current Authenticator release
- Revoke refresh tokens and review sign-in logs for users on affected Authenticator builds with work accounts
Workarounds
- Remove work accounts from, or block access for, unmanaged Android devices that cannot be updated
- Use Conditional Access to require compliant or managed devices for Microsoft 365 access
Longer-term hardening
- Enforce MDM/Intune app-protection and compliance policies with a minimum Authenticator version
- Restrict sideloading and unvetted app installs on devices holding work accounts
- Monitor Entra ID sign-in logs and Microsoft Graph activity for anomalous token issuance to Microsoft first-party client IDs from mobile devices
- Review changes to authentication methods and passkeys on accounts that signed in from Android devices
CVEs associated with Microsoft Authenticator for Android Flaw (CVE-2026-80097
Weaknesses (CWE) in Microsoft Authenticator for Android Flaw (CVE-2026-80097
Timeline of Microsoft Authenticator for Android Flaw (CVE-2026-80097
- Microsoft Authenticator for Android 6.2606.4246 containing the fix was released (July 2026; the source gives month precision only, day shown is a placeholder)
- ENISA EUVD-2026-73327 record created for CVE-2026-80097, which is not listed in CISA KEV
- Enclave's AuthMask write-up by Ofek Levin documents the exported AccountChooserActivity caller-validation flaw, with MSRC publication cited as 2026-09-08 (the report date to Microsoft is not stated)
- CVE-2026-80097 published (CWE-287, CVSS 8.6) and listed in Microsoft's September 2026 security updates; Microsoft marked it as not exploited
- Tenable's record for CVE-2026-80097 updated, referencing MSRC and ENISA EUVD-2026-73327
- CVE-2026-80097 record last modified; affected range recorded as Authenticator for Android 6.0.0 up to but excluding 6.2606.4246
- Cyber Security News reported Enclave's research showing a zero-permission malicious app can impersonate Microsoft apps via AccountChooserActivity and obtain delegated tokens
Sources cited for Microsoft Authenticator for Android Flaw (CVE-2026-80097
- Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions
- Enclave: AuthMask - We Made Microsoft Authenticator Hand Over Tokens
- MSRC Security Update Guide: CVE-2026-80097
- NVD: CVE-2026-80097
- OpenCVE: CVE-2026-80097
- Tenable: CVE-2026-80097
- SentinelOne Vulnerability Database: CVE-2026-80097
- ENISA EUVD: EUVD-2026-73327
- Lutra Security Field Guide: CVE-2026-80097
- STAR Labs Patch Tuesday 2026-09: CVE-2026-80097
Detection coverage for TL-2026-4431
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4431 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.