Microsoft fixed a serious flaw in Microsoft Authenticator for Android in September, and researchers only published the details on Oct. 23. Microsoft's advisory for CVE-2026-80097 lists the fixed build as 6.2606.4246 and rates the bug 8.6 out of 10.
What the flaw is
The researchers at Enclave call it AuthMask. Microsoft's entry names it an improper authentication bug that lets an attacker raise their privileges on the device.
Enclave says Authenticator exposed an Android screen, AccountChooserActivity, that any app on the phone could open. It says the app never used the caller's real identity to decide whether to trust it.
What an attacker could get
Enclave says a malicious app with no permissions could pose as Teams and ask for Microsoft Graph tokens. It reports that these covered mail, calendar, files and chat for the signed-in work account.
Microsoft's description is narrower on one point. It says an attacker would need to convince the user to complete an authentication flow in Authenticator. Enclave says no user action was needed beyond a signed-in work account.
Who is affected
Enclave says the attack needs Authenticator installed with a work account signed in. Its post says versions before 6.2606.4246 are affected.
Microsoft's entry marks customer action as required. Its data at the time of our check lists the bug as not publicly disclosed and not exploited. We found no report of attacks in the wild.
What to do
Update Microsoft Authenticator from Google Play. The Play listing showed version 6.2609.6214, updated Oct. 26, when we checked, which is newer than the fixed build. Play may offer a different version by device.
To check, open Android Settings > Apps > Microsoft Authenticator and read the version at the bottom. Anything below 6.2606.4246 needs the update.
IT admins should require 6.2606.4246 or newer for work accounts, using their device management tool.
Why it matters
The fix has been out for about seven weeks, so anyone with automatic updates on is likely covered. The risk is phones that never updated. The bug shows how much trust an authentication app holds. For more on securing logins, see how to set up passkeys on iPhone and Android. For other Android threats, see the Android scam protections checklist.
