Microsoft Authenticator for Android Bug May Have Exposed Work Tokens

CVE-2026-80097 Authenticator is a security vulnerability in the Microsoft Authenticator app for Android, whose analysis was published by Enclave on October 23. Microsoft fixed the vulnerability on September 8, 2026. According to the research, a malicious app installed on the device could obtain work-account refresh tokens and use them to access corporate services.

Microsoft tracks the bug as an elevation-of-privilege issue with a CVSS score of 8.6. Versions of Microsoft Authenticator for Android older than 6.2606.4246 are affected. Users and administrators should therefore verify that this version or a newer one is deployed.

CVE-2026-80097 Authenticator and the Attack Method

Enclave named its research AuthMask. According to its technical description, an unprivileged app could impersonate an installed Microsoft app. It could then receive refresh tokens from Authenticator intended for the sign-in flow.

The attack was not a remote compromise of an arbitrary user. It assumed that a malicious app was already installed on the Android device and that the user was signed in to a work account in Authenticator. Those accounts, used for example in Microsoft 365 environments, are at the core of the reported risk.

The researchers state that the obtained tokens could have been used to access corporate data and services. In this case, Authenticator acts as a sign-in broker between the account and applications, so the bug could have undermined trust in the application’s identity without the malicious program needing sensitive Android permissions.

What Is Confirmed and What Remains Unclear

The release of a fix and the version from which Microsoft Authenticator for Android is protected according to the available materials are confirmed: 6.2606.4246. Microsoft’s record classifies the issue as an elevation of privilege and assigns it a CVSS score of 8.6.

Some technical details come primarily from Enclave’s tests. This concerns the specific scope of permissions obtained by the tokens as well as claims about possible passkey manipulation. The content of Microsoft’s official advisory could not be loaded through the available interface, so these points cannot be independently compared with the manufacturer’s detailed statement.

The exact user-interaction requirement is also unclear. Enclave describes a scenario in which no further interaction may have been necessary after the malicious app was installed. Secondary sources, however, cite Microsoft’s classification as requiring user interaction. The provided materials also do not confirm exploitation of CVE-2026-80097 in the wild.

What Administrators Should Do

In organizations using Microsoft Authenticator on Android devices, a practical step is to enforce a minimum version of 6.2606.4246 or later through MDM. Administrators should also identify devices with an outdated app and verify the update, especially for users with Microsoft 365 work accounts.

Further developments will depend on any additional information from Microsoft or CISA. Particularly relevant will be confirmation of whether the bug was exploited in real-world attacks and a more detailed explanation of the fix, including the conditions for user interaction.

Verified and updated: October 27, 2026 15:26