Guide · Account security

The Microsoft Authenticator flaw: what your business should do

Late in October researchers showed how a harmless-looking Android app could make Microsoft Authenticator hand over the keys to a work Microsoft 365 account. The headlines arrived weeks after the fix did. Here is what the flaw was, who it reached, whether anyone used it, and the short list of things worth doing about it in a small business.

By Elliot · Published 26 October 2026 · 8 min read

In brief

The flaw is in the Android app only, and Microsoft fixed it in version 6.2606.4246.
An attacker first needed their own app installed on the same phone. It could not be done from the internet.
Nobody has reported it being used in real attacks.
Make sure every phone has updated, then use the moment to move the team to passkeys.

What happened

An app with no permissions, posing as Teams

On Android, Microsoft Authenticator does more than show approval prompts. It acts as a sign-in broker: when Teams or Outlook on the same phone needs to prove who you are, they ask Authenticator, and it hands back a token. A token is a time-limited pass that lets an app use your account without asking for your password again.

The researchers at Enclave found that one of the doors into that broker trusted the caller's word about who it was. A malicious app could claim to be Teams, or Authenticator itself, and get real tokens back for the phone's work account, in plain text. It needed no Android permissions at all, which is what makes the finding striking: the app would look harmless in any permissions check.

The timeline matters, because much of the coverage reads as if this were breaking news. Microsoft published the advisory on 8 September 2026 in its monthly security release, with the fix already in the app. Enclave published its technical write-up on 23 October, and the press picked it up over the following days. Phones that update automatically have been protected for weeks.

AuthMask at a glance
Name	CVE-2026-80097, called AuthMask by the researchers who found it
App	Microsoft Authenticator for Android. iPhone is not listed as affected
Rating	High. Microsoft scores it 8.6 out of 10 (CVSS 3.1) and rates it Important
What an attacker needs	Their own app already installed on the same phone. It needs no Android permissions
What they could get	Sign-in tokens for the phone's work or school Microsoft account
Fixed in	Android version 6.2606.4246. Microsoft published the advisory on 8 September 2026
Exploited?	No known attacks. Not on CISA's list of exploited flaws as of 23 October 2026

How big a deal

A widely used app, and its third fix this year

Store figures read on 26 October 2026. Microsoft does not publish a user count.

100m+

downloads of Microsoft Authenticator from Google Play

Source: Google Play

Authenticator security flaws Microsoft has fixed and disclosed in 2026

Source: Microsoft (MSRC)

of them on CISA's catalogue of vulnerabilities known to be exploited

Source: CISA, 23 October 2026

AuthMask is the third Authenticator flaw Microsoft has disclosed in 2026. All three follow the same pattern: the attacker needs something already on your phone, or needs you to approve a request you did not start. None can be triggered from the internet alone. That is good news for anyone who keeps apps updated and is careful about what they install.

Microsoft Authenticator flaws disclosed in 2026, and the versions that fix them
Flaw	What it allowed	Score	Fixed in
CVE-2026-2612310 March 2026	A rogue app chosen to open a sign-in link could read a one-time sign-in code	5.5 Medium	Android 6.2511.7533, iPhone 6.8.40
CVE-2026-4161514 May 2026	Approving a fake but convincing sign-in request could send a work-account token to an attacker	9.6 Critical (NIST: 7.4)	Android 6.2605.2973, iPhone 6.8.47
CVE-2026-800978 September 2026	A rogue app with no permissions could pose as Teams or Authenticator and collect work-account tokens	8.6 High	Android 6.2606.4246

Who it reaches

Which phones and accounts were in scope

What the advisory and the research actually cover, and where they say nothing.

Staff with work accounts on Android

The demonstrated attack used a phone with Authenticator signed in to a Microsoft 365 work or school account. That is the set-up most small businesses on Microsoft 365 hand their team: Authenticator on a personal Android phone for the login prompts.

Phones that do not update apps

Google Play updates apps automatically by default, and Microsoft says those phones got the fix without anyone doing anything. The risk sits with phones where automatic updates were switched off, are paused on mobile data, or have not been opened in months.

Phones with apps from outside Google Play

Every attack in this family needs a hostile app on the same phone. Sideloaded apps, modified games and 'free' versions of paid apps are the obvious route in. A phone that only ever installs from Google Play is a much harder target.

iPhone users

Microsoft's advisory for AuthMask lists Android only, and the researchers tested only Android. iPhone users should still keep Authenticator current, because the two earlier 2026 flaws below did affect the iPhone app.

Personal Microsoft accounts

Neither Microsoft nor the researchers say whether a personal Outlook.com or Xbox account in Authenticator was exposed. The demonstration used work accounts. Treat personal accounts as unconfirmed rather than safe, and update anyway.

Codes for Google, Facebook and others

Many people keep six-digit codes for other services in Authenticator. No source says AuthMask reached those codes, and none says it could not. Nothing in the public write-up touches them, so we would not panic about them, but the update covers them too.

What to do

Six steps, from a team message to passkeys

The first two are for everyone with the app. The middle three are for whoever looks after your Microsoft 365 account. The last is the change that makes the next Authenticator headline matter less.

Update Authenticator on every phone

On Android, open Google Play, search for Microsoft Authenticator and tap Update if it appears. You need 6.2606.4246 or later; the Play listing showed 6.2609.6214 on 26 October. On an iPhone, do the same in the App Store. One message to the team, today, covers most of the risk.

Check the version if you are not sure

On Android, go to Settings, Apps, Authenticator, App details and read the version number. On an iPhone, Settings, General, iPhone Storage, Authenticator shows it. Compare the whole number, not just the first part: every version starts with 6.

Admins: see every user's version in one place

Microsoft Graph records the Authenticator version each person registered, in a field called phoneAppVersion, even on phones your business does not manage. A short PowerShell or Graph query lists everyone below 6.2606.4246. If your phones are in Intune as Android Enterprise devices, managed Google Play can push app updates as high priority.

Clear out apps nobody can explain

Ask staff to remove apps they do not recognise or no longer use, and to install only from Google Play or the App Store. All three Authenticator flaws this year needed a hostile app on the same phone or a fake approval, so this habit protects against the next one as well.

Only on suspicion: revoke sessions

If someone had an out-of-date Authenticator and an app they cannot account for, use Revoke sessions on their account in the Microsoft Entra admin centre. That kills their refresh tokens; Microsoft notes existing access tokens can last up to an hour. Then review their sign-in methods and sign-in logs. Nobody has reported attacks, so revoking everyone is not called for.

Move the team to passkeys

A passkey is a sign-in that cannot be phished, and since 1 September 2026 it is the default for Microsoft Entra. The NCSC now recommends passkeys wherever a service offers them. Authenticator can hold a passkey itself, so this is a settings change for most small businesses, not a new app.

Where the sources disagree

What is still unclear, and why we are not alarmed

Microsoft's scoring says the user has to do something, such as completing a sign-in in Authenticator, for the attack to work. The researchers say that in their tests no extra action was needed once the rogue app was on the phone. We have not tried to settle that, and we would rather tell you both than pick the comforting one. Either way, the app has to get onto the phone first.

Some coverage of the May flaw, CVE-2026-41615, called it actively exploitable. Microsoft and CISA both record no exploitation, and nothing primary we could find says otherwise. Microsoft scored that one 9.6, while NIST's own analysis put it at 7.4. Scores are a rough guide to how bad a flaw could be, not a measure of how likely it is to be used against you.

The real lesson for a small business is about where your sign-ins live. An authenticator app on a phone is now the master key to email, files and chat, which makes the phone part of your security whether you manage it or not. Keeping apps updated, being strict about what gets installed, and moving to passkeys deals with most of the risk without buying anything new.

FAQ

Microsoft Authenticator questions, answered

What is the Microsoft Authenticator vulnerability CVE-2026-80097?

CVE-2026-80097, nicknamed AuthMask, is a flaw in Microsoft Authenticator for Android that Microsoft fixed in version 6.2606.4246 and disclosed on 8 September 2026. A malicious app on the same phone, needing no Android permissions, could pretend to be a Microsoft app such as Teams and receive sign-in tokens for the phone's work or school account. Microsoft rates it High, 8.6 out of 10.

Is it being used in attacks?

Not as far as anyone has reported. Microsoft marks it as not exploited, CISA's assessment records no exploitation, and it is not in CISA's catalogue of known exploited vulnerabilities as of 23 October 2026. The news in late October was the researchers' detailed write-up, published on 23 October, weeks after the fix shipped.

Which version of Microsoft Authenticator is safe?

On Android, 6.2606.4246 or later fixes AuthMask; Google Play listed 6.2609.6214 on 26 October 2026. That release is also past the fixes for the two earlier 2026 flaws. On iPhone, 6.8.47 or later covers both earlier flaws, and the App Store listed 6.8.57 on 26 October.

Does this affect Microsoft Authenticator on iPhone?

Microsoft's advisory for CVE-2026-80097 lists the Android app only, and the researchers tested Android only. The two earlier 2026 Authenticator flaws, CVE-2026-26123 and CVE-2026-41615, affected both Android and iPhone and are fixed in iPhone versions 6.8.40 and 6.8.47.

Should we stop using Microsoft Authenticator?

No. An up-to-date Authenticator is still far stronger than a password alone or a text-message code, and the NCSC ranks app approvals with number matching above codes. The better move is to keep it updated and register a passkey for each person, which Authenticator can hold.

Does Conditional Access or token protection stop this?

Not on Android. Microsoft's token protection feature supports Windows, iOS, iPadOS and macOS, not Android, and the tokens were issued on the user's own phone, so a device compliance rule would pass. Location-based policies and continuous access evaluation can limit where stolen tokens work, but they need Entra ID P1 or P2, which Microsoft 365 Business Premium includes and Business Standard does not.

What did the attacker get access to in the demonstration?

In the researchers' tests the tokens gave the abilities of the Microsoft apps being impersonated: reading and sending email, files, calendar, Teams chat and SharePoint, and, through Authenticator's own access, managing the account's sign-in methods. That last part is why an admin who suspects an incident should check the user's registered methods as well as revoking sessions.

References