Security researcher Ofek Levin identified a vulnerability in the Microsoft Authenticator app for Android, dubbed the AuthMask attack chain. This flaw allows an unauthorized application to impersonate a trusted Microsoft app and intercept account tokens.
The vulnerability stems from the AccountChooserActivity component, which was marked as exported. This configuration allowed any application on the device to trigger the activity within the auth process, leading to unauthorized access to email, files, and calendar data.
Microsoft has acknowledged the issue and assigned it the identifier CVE-2026-80097. A patch has been released to address the security gap in the Android version of the authenticator application.
Users are advised to update their Microsoft Authenticator app immediately. Versions prior to 6.2606.4246 are confirmed to be affected by this security flaw.
