Microsoft patches high-severity Android Authenticator flaw

Microsoft has released a patch for a high-severity security vulnerability in its Android Authenticator app, tracked as CVE-2026-80097 and nicknamed ‘AuthMask’. The flaw, which carries a CVSS score of 8.6, allowed malicious Android applications to impersonate legitimate Microsoft services, such as Teams, to intercept authentication tokens.

Security researchers from Enclave, including Ofek Levin, demonstrated that an app without special system permissions could exploit a weakness in the app’s identity broker. By providing false signature information, a malicious app could trick the Authenticator into granting access to sensitive Microsoft Graph tokens. This could allow unauthorized access to corporate emails, files in OneDrive and SharePoint, calendars, and chat messages.

The vulnerability affects all versions of Microsoft Authenticator for Android from 6.0.0 up to, but not including, version 6.2606.4246. Microsoft addressed the issue in its September 8 Patch Tuesday release. While researchers demonstrated a proof-of-concept, there have been no reports of this specific vulnerability being exploited in the wild.