# Microsoft Authenticator for Android Flaw (CVE-2026-80097, AuthMask) Lets Malicious Apps Steal Account Tokens With Zero Permissions

> CVE-2026-80097 (AuthMask) is a local elevation-of-privilege flaw (CWE-287, CVSS 8.6) in Microsoft Authenticator for Android caused by improper caller authentication in the exported broker activity com.microsoft.identity.client.AccountChooserActivity. Enclave researcher Ofek Levin showed a zero-permission malicious app can impersonate Microsoft apps such as Teams and obtain access, refresh and ID tokens without user approval; versions before 6.2606.4246 are affected and a fix has shipped.

- **Published:** 2026-10-26T06:46:22Z
- **Last reviewed:** 2026-10-26T06:46:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4431
- **ID:** TL-2026-4431
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-80097

## Description

Microsoft Authenticator for Android (com.azure.authenticator) includes a broker component that hands delegated tokens to trusted Microsoft apps on the device. The activity com.microsoft.identity.client.AccountChooserActivity runs in the :auth process and is marked android:exported="true", so any installed app can launch it without holding any Android permission.

Per Enclave's AuthMask write-up, the broker validated the caller identity claimed in the request rather than the identity of the actual calling app. Its signature check compared the claimed package's redirect URI against stored values. Because the attacker controls the request, the attacker can compute the legitimate redirect URI for the app they want to impersonate and pass the check. The caller's real package name, UID and signing certificate were not used to decide trust.

The attacker app sends an explicit intent whose extras include a broker_request_v2 JSON object (client_app_name, client_id, redirect_uri, scopes, authority, username), a spoofed caller.info.uid matching the target app, and common.broker.protocol.version.name set to 20.0. Enclave demonstrated impersonating Microsoft Teams (client ID 1fec8e78-bce4-4aaf-ab1b-5451cc387264) with Microsoft Graph scopes such as Mail.ReadWrite, Files.ReadWrite.All and Calendars.ReadWrite. It also demonstrated the Teams chat backend (api.spaces.skype.com, user_impersonation scope) and Authenticator's own client with UserAuthenticationMethod and Passkey management scopes. The broker returned access_token, refresh_token, id_token and client_info in plaintext through broker_result_v2_compressed. This worked on devices with a signed-in work account, with no consent prompt shown to the victim.

Stolen delegated tokens can reach Microsoft Graph resources such as mailboxes, calendars, OneDrive, SharePoint and Teams. The permissions to manage authentication methods and passkeys raise the risk of persistence on the account.

The CVE was published on 2026-09-08 with CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (8.6); Lutra's record also lists E:U/RL:O/RC:C. Affected versions are Authenticator for Android 6.0.0 up to but excluding 6.2606.4246; the fix shipped in July 2026 (month precision only). The vector carries UI:R, so the user must install or open the attacker's app. STAR Labs' Patch Tuesday tracker rates it Not Exploited / Less Likely with unproven exploit maturity, and the CVE is not in CISA KEV. No in-the-wild exploitation, named threat actor, or network IOCs are reported. Enclave's article includes inline code showing the attack chain, but no standalone downloadable PoC was identified.

Defender relevance: the risk is on unmanaged or BYOD Android devices carrying work accounts. Update Authenticator through Google Play, enforce minimum-app-version and compliance policies via Intune/MDM, restrict sideloading, and hunt Entra ID sign-in logs for unexpected token issuance to Microsoft first-party client IDs (for example Teams) from mobile devices on pre-fix Authenticator builds.

## MITRE ATT&CK

- T1404 Exploitation for Privilege Escalation
- T1635 Steal Application Access Token
- T1528 Steal Application Access Token
- T1655 Masquerading
- T1550.001 Application Access Token
- T1550.001 Application Access Token

## Sources

- [Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions](https://cybersecuritynews.com/microsoft-authenticator-flaw/)
- [Enclave: AuthMask - We Made Microsoft Authenticator Hand Over Tokens](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens)
- [MSRC Security Update Guide: CVE-2026-80097](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097)
- [NVD: CVE-2026-80097](https://nvd.nist.gov/vuln/detail/CVE-2026-80097)
- [OpenCVE: CVE-2026-80097](https://app.opencve.io/cve/CVE-2026-80097)
- [Tenable: CVE-2026-80097](https://www.tenable.com/cve/CVE-2026-80097)
- [SentinelOne Vulnerability Database: CVE-2026-80097](https://www.sentinelone.com/vulnerability-database/cve-2026-80097/)
- [ENISA EUVD: EUVD-2026-73327](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73327)
- [Lutra Security Field Guide: CVE-2026-80097](https://fieldguide.lutrasecurity.com/CVE-2026-80097/)
- [STAR Labs Patch Tuesday 2026-09: CVE-2026-80097](https://onlyfm252.starlabs.sg/patch-tuesday/2026-09/cve-2026-80097/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4431