> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft Authenticator Android Bug Leaked Work Tokens
- URL: https://blog.harshkohli.com/microsoft-authenticator-android-token-flaw/
- Published: 2026-10-27T15:05:53.000Z
- Updated: 2026-10-27T15:05:53.000Z
- Description: A zero-permission Android app could pose as Teams and get work account tokens from Microsoft Authenticator. The fix is out; here is what to check.
- Author: Harsh Kohli
- Tags: Tech News, Software

If your job has you signing into Outlook or Teams through Microsoft Authenticator on an Android phone, check the app version today. Researchers have published details of a bug that let a sketchy app with no permissions at all trick Authenticator into handing over work account tokens. Microsoft has already fixed it, so this is mostly an update-and-move-on story.

## What happened

Ofek Levin at the security firm Enclave published a write-up called [AuthMask](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens?ref=blog.harshkohli.com) showing the problem. On Android, Authenticator acts as a sign-in broker. When Teams or Outlook needs you logged in, it asks Authenticator, which hands back a token that works like a pass for your account.

The research found that an ordinary app could open one exposed screen inside Authenticator and simply claim to be Teams. A signature check was meant to block that, but it checked the real Teams app's signature, which was right there on the phone, instead of checking who actually sent the request. In Enclave's tests, the tokens it got back gave delegated access to mail, files and calendars for the work account on that phone.

Microsoft tracks the bug as [CVE-2026-80097](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097?ref=blog.harshkohli.com), rated 8.6 and labelled Important, and fixed it in Authenticator for Android version 6.2606.4246 as part of September's Patch Tuesday. [The Hacker News](https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html?ref=blog.harshkohli.com), which [shared it on X](https://x.com/TheHackersNews/status/2115053633763196968?ref=blog.harshkohli.com), notes Microsoft says the flaw wasn't exploited before the fix.

## Why it matters

One thing the two sides disagree on. Enclave says its proof of concept got tokens with no user interaction beyond having an account signed in. Microsoft's advisory says an attacker would need you to install a malicious app and then complete a sign-in step in Authenticator. Either way, the risk depended on a bad app getting onto your phone first, which is a good reminder that sideloaded APKs and random "utility" apps aren't harmless.

It also shows how much rides on one app. Authenticator holds the keys to your whole work identity, so a slip in how it decides who to trust affects every Microsoft service behind it. It only touched the work account signed into that device, not personal accounts on other phones.

## What to do

- Open the Play Store, search for Microsoft Authenticator and update it. Version 6.2606.4246 or newer has the fix. You can see your version in the app's settings under About.
- Remove apps you don't recognise or don't use, especially anything installed outside the Play Store.
- If you manage company phones, set that version as the minimum in your device management tool.
- If anything looks off in your work mailbox, tell IT. Neither Microsoft nor the researchers say whether updating cancels tokens an app may already have grabbed.

Microsoft is also rolling out AI checks for phishing in Teams chats, which I wrote about in [this earlier post](https://blog.harshkohli.com/microsoft-teams-ai-phishing-detection/). Between the two, it's been a busy month for Microsoft's work-account security.