Enclave's October 23 write-up shows how CVE-2026-80097, a Microsoft Authenticator for Android flaw published on September 8, let an app with no permissions collect work account tokens. The CVE isn't new, but the details are a good reason to confirm your Android fleet took the fix.
What happened
Microsoft published CVE-2026-80097 on September 8, 2026, as an elevation of privilege vulnerability, and Expert Insights reports the update shipped that day. The CVE record lists Authenticator for Android from 6.0.0 up to, but not including, 6.2606.4246, with a CVSS score of 8.6. Expert Insights reports that Microsoft rated it Important and listed it as neither exploited nor publicly disclosed, and OpenCVE shows it isn't in CISA's KEV catalog. Microsoft's advisory page didn't load when this was written, so these details come from the CVE record and secondary reporting.
Enclave researcher Ofek Levin published the technique as AuthMask on October 23. According to Enclave, other apps could launch the exported AccountChooserActivity, which took the caller's package name, UID and redirect URI from the request itself. Authenticator then rebuilt the expected redirect URI from the claimed app's installed signature. An attacker can read that signature, so the check always passed.
Enclave says the broker returned access, refresh and ID tokens in plaintext for the signed-in work account. Posing as Teams against Microsoft Graph returned delegated scopes for mail, files, calendars and Teams messages. For impersonation of Authenticator's own client, Enclave's scope list shows UserAuthenticationMethod.ReadWrite, Passkey.Create and Passkey.Delete.
The sources disagree on user interaction. Enclave says none was needed beyond a signed-in work account in the broker, with the malicious and impersonated apps on the device. The CVSS vector says user interaction is required, and The Hacker News describes the user being convinced to complete an authentication flow. Plan for the worse case.
Why it matters
A broker is a trust anchor: it holds sign-in state and issues tokens to other apps, so it has to know who is really asking. Here, a package name and a public signature were treated as proof of identity, while Enclave says the real caller's package name was used only for bookkeeping.
The refresh token raises the stakes. Microsoft's documentation gives most refresh tokens a default 90-day lifetime. Neither Enclave nor the CVE record says that updating Authenticator invalidates tokens already issued, so treat the update as closing the hole, not cleaning up after it.
Scope has limits too. Microsoft's MSAL documentation says the broker component also ships in Intune Company Portal and Link to Windows, but this CVE names only Authenticator. Enclave doesn't discuss those apps, work profile separation or Conditional Access, so don't assume any of them changes the outcome.
What to check in your environment
- Check versions in Intune. Export Apps > Monitor > Discovered apps and look for Authenticator below 6.2606.4246. The report refreshes about every seven days per device.
- Cover the blind spots. Intune doesn't collect unmanaged apps from personal devices. Ask users of unenrolled phones or personal-profile copies to update from Google Play and confirm the version.
- Review the update mode. Microsoft documents that managed Google Play's Postponed mode delays updates by 90 days. Set Authenticator to High Priority until the fleet is current.
- Review app installation rights. The attack needs a malicious app on the device. Fully managed devices allow only approved apps by default, so find any policy setting Allow access to all apps in Google Play store to Allow.
- Revoke tokens on suspect phones. After updating and removing unexplained apps, use Revoke sessions on the user's Entra Overview page, or
Revoke-MgUserSignInSession. Microsoft notes that access tokens keep working until they expire, one hour by default, unless the app supports continuous access evaluation. - Check authentication methods. For those users, review Entra ID > Authentication methods > Activity and their registered methods for anything they didn't add.
- Review activity. Enclave publishes no indicators. For suspect accounts, review sign-in logs for unfamiliar devices and locations, then check mail sent, files changed and Teams messages posted.
References
- Enclave: AuthMask write-up
- Microsoft: CVE-2026-80097
- OpenCVE: CVE-2026-80097 record
- Expert Insights: Authenticator flaw coverage
- The Hacker News: ThreatsDay roundup
- Microsoft: Intune discovered apps
- Microsoft: Managed Google Play apps
- Microsoft: Revoke user access
- Microsoft: Refresh tokens
- Microsoft: Cross-app SSO on Android
- Microsoft: Authentication methods activity