Microsoft Authenticator Flaw Allowed Rogue Apps to Steal Work Tokens
Researchers from Enclave have disclosed a serious security hole in the Android version of the Microsoft Authenticator app, CVE-2026-80097. Using the vulnerability, an unauthorized Android app without any privileges was able to pose as trusted Microsoft applications and steal work account tokens from them.
To mitigate this issue, Microsoft has issued a security update in September, requiring immediate updates on all enterprise devices from IT administrators. As described by the researchers, the “AuthMask” vulnerability has to do with how requests are being received by the Microsoft Authenticator application via its brokered activities.
As explained by researchers at Enclave, any malicious app on the device could make use of the Authenticator app by providing it with a fake caller identity, including package name and URI redirects. While Authenticator does perform signature validation of the installed packages such as Microsoft Teams, it was not verifying whether the actual process that made the request corresponds to the provided one.
From an operational perspective, the use of such tokens effectively provided any external entity complete delegated access to corporate mailboxes, cloud file services, and calendar databases without any need to intervene in administrator functions.
Although Microsoft considered the bug to be user-dependent and active exploits unlikely, the security analysts stressed that it is crucial for broker applications to perform stringent caller validation checks. Enterprise organizations that handle enterprise mobility infrastructure swiftly distributed patches through the Google Play Store to prevent credential theft vulnerabilities.
The present security issue demonstrates persistent security challenges related to interprocess communication of mobile applications and identity brokering. With more enterprises adopting mobile-based multifactor authentication, the security of credential transfer mechanisms becomes important for cloud infrastructure protection against software impersonation.
The prompt action by Microsoft to patch the Authenticator token bug emphasizes the importance of conducting a thorough audit of software to ensure that there is no breach of identity validation control in enterprise authentication chains. Mobile identity brokers must be secure from application access to prevent any attack on cloud infrastructure.
