An Android app with zero permissions could impersonate any installed Microsoft first-party app and obtain tokens for a signed-in work account through Microsoft Authenticator.
Ofek Levin, a researcher with security firm Enclave, detailed the technique, which Enclave calls AuthMask, in research published Oct. 23, 2026, and said Microsoft fixed the flaw in September.
Microsoft classified CVE-2026-80097, an improper-authentication flaw titled “Microsoft Authenticator Elevation of Privilege Vulnerability,” as Important, with a Common Vulnerability Scoring System (CVSS) score of 8.6.
Its security update was released Sept. 8, 2026, and the advisory lists the flaw as neither exploited nor publicly disclosed before then. Enclave’s report found no evidence of exploitation in the wild.
The attack required a malicious app already installed on a device with Authenticator and a signed-in work account. Enclave said no further user interaction was needed, though Microsoft’s scoring classifies it as a local attack that requires user interaction.
Authenticator Checked The Claimed App, Not The Caller
The flaw sat in an account-selection activity in Authenticator that any app on the device could launch. It accepted identity details supplied by the caller, including which app was supposedly making the request.
Authenticator matched the request’s redirect address against the installed signature of the app the caller named. Because that app was genuinely installed, the check passed, validating the claimed identity rather than the app that had actually called.
Enclave found that Authenticator could identify which app had launched it, but that information was not used in any trust decision.
In the company’s tests, impersonating Microsoft Teams and requesting access to Microsoft Graph returned access and refresh tokens carrying delegated access to a user’s mail, files, calendars, and SharePoint sites, including sending mail and Teams messages. A refresh token lets its holder obtain new access tokens without signing in again until it expires or is revoked.
Enclave tested two other impersonations. Posing as Teams’ chat backend returned a scope that let the app act as the user there, and posing as Authenticator’s own client returned scopes that included creating and deleting passkeys.
Microsoft’s CVE record lists Authenticator for Android versions before 6.2606.4246 as affected, and Enclave advised anyone using the app on Android to update it. The research was conducted by Levin through the Enclave Fellowship Program.
