Microsoft Authenticator Handed Work Account Tokens to Any Android App That Simply Claimed to Be Teams

The app companies trust to guard Microsoft work accounts on Android would hand over the keys to anyone who asked politely. Until a September fix, Microsoft Authenticator gave mailbox, file, calendar and Teams tokens to any app on the phone that said it was Teams, and that app needed zero Android permissions to do it.

Researcher Ofek Levin of security firm Enclave published the details on October 23 under the name AuthMask.

A broker that took callers at their word

On Android, Authenticator acts as a broker. Teams, Outlook and other Microsoft apps ask it to sign the user in, and it hands back tokens.

Authenticator exposed a screen, AccountChooserActivity, that any app on the device could launch. Every detail of the request came from the caller: app name, package name, client ID, redirect URI, scopes and caller ID. The validation step looked up the signature of the package the caller claimed to be and compared it with the redirect URI the caller supplied.

Because the real Teams is installed, a malicious app could read that signature from the system and build a matching value. The check always passed. "It never asked: Is the app making this request actually Teams?" Enclave wrote.

The irony is that Authenticator did know who was really calling. It read the true caller's package name, but only used it for bookkeeping and never for a trust decision.

What a disguise was worth

Access, refresh and ID tokens came back in plaintext the malicious app could parse. Enclave's setup was simple: Authenticator installed with one work account signed in.

Posing as Teams and requesting Microsoft Graph produced rights to read and write mail, send mail, read and write all files, read and write calendars, send chat messages and reach SharePoint sites. Posing as the Teams chat backend allowed user impersonation.

The worst disguise was Authenticator's own client. That yielded rights to change sign-in methods and to create and delete passkeys. As Help Net Security notes, an attacker who adds their own passkey can keep getting in even after the malicious app is gone. Stolen sessions are already a proven way around MFA, as the token spray that hit 79 organizations showed.

The two sides describe the bar for attack a little differently. Enclave says nothing was needed beyond the broker being present with a signed-in work account. Microsoft's advisory says an attacker would have to get a malicious app installed and convince the user to complete an authentication flow.

Patched in September

Microsoft confirmed and fixed the bug as CVE-2026-80097, published September 8, 2026. It is rated Important with a CVSS score of 8.6 and classed as improper authentication (CWE-287). Microsoft said the flaw had not been publicly disclosed or exploited at the time and rated exploitation less likely.

Authenticator for Android versions before 6.2606.4246 are affected. Updating to that build or later closes the hole, and IT teams can have their MDM enforce it as a minimum version. Since the attack still depends on a malicious app landing on the phone, sideloaded and unfamiliar apps remain the way in.

Some offers on this page may be paid placements or contain affiliate links.