Security researcher Ofek Lev has disclosed the AuthMask attack chain, which exploits a vulnerability in the Microsoft Authenticator app for Android. The flaw, tracked as CVE-2026-80097, allowed malicious applications to impersonate legitimate Microsoft apps and obtain account tokens.
The vulnerability existed in the authentication broker component. Malicious apps could manually specify an application name, package name, client ID, and redirect URI in their requests. The authenticator failed to verify the true identity of the calling application, instead relying on the provided claims.
By impersonating apps like Microsoft Teams, attackers could gain delegated permissions to read emails, access files, modify calendars, and interact with SharePoint content. Furthermore, the exploit allowed attackers to manage authentication methods and modify passkeys.
The issue affected Microsoft Authenticator for Android versions 6.0.0 through 6.2606.4246. Microsoft released a patch in version 6.2606.4246 on September 8. The researcher waited 50 days after the fix before disclosing the technical details.
