AuthMask: Microsoft Authenticator hands tokens to an app with zero permissions
Comments on “AuthMask: Microsoft Authenticator hands tokens to an app with zero permissions”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Enclave researchers report that an Android app with no permissions could get Microsoft Authenticator to return tokens for a signed-in work account. The exported AccountChooserActivity trusted caller-supplied data, and its signature check compared values the caller could build from the installed target app. Posing as Teams and requesting Graph, they obtained mail, files and calendar scopes. Microsoft reportedly fixed it as CVE-2026-80097 (CVSS 8.6) in version 6.2606.4246. The findings and patch details are unverified. Builders of brokers should authenticate the actual caller.
Why it ranked
No. 5 of 155 with a score of 0.73. The panel rated it highest on new information (0.93) and technical depth (0.91), lowest on audience breadth (0.51).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, reproducible Android broker auth bypass with primary-source code walkthrough and CVE; strong technical depth and practical security relevance, though impact is confined to one widely used app.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, reproducible Android broker-authentication exploit exposes high-impact token theft, includes code-level root cause, scope evidence, CVE and fixed-version guidance. It is highly relevant to security-minded builders, though limited to Microsoft Authenticator on Android.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.2
- Significance0.70
- Reader interest0.84
- Audience breadth0.51
- Practical relevance0.76
- Substantiated0.85
- Technical depth0.91
- New information0.93
- Counts against: Promotional0.04
- Counts against: Overclaim0.15
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.68 | 0.62 | 0.82 | 0.70 | 0.20 | +0.24 | +0.169 |
| Reader interest | 0.78 | 0.82 | 0.93 | 0.84 | 0.15 | +0.26 | +0.219 |
| Audience breadth | 0.35 | 0.70 | 0.48 | 0.51 | 0.35 | +0.13 | +0.066 |
| Practical relevance | 0.77 | 0.72 | 0.78 | 0.76 | 0.06 | +0.22 | +0.166 |
| Substantiated | 0.78 | 0.85 | 0.92 | 0.85 | 0.14 | +0.05 | +0.043 |
| Technical depth | 0.99 | 0.85 | 0.90 | 0.91 | 0.14 | +0.05 | +0.046 |
| New information | 0.90 | 0.90 | 0.98 | 0.93 | 0.08 | +0.05 | +0.046 |
| Promotional | 0.04 | 0.04 | 0.03 | 0.04 | 0.01 | −0.19 | −0.007 |
| Overclaim | 0.26 | 0.12 | 0.08 | 0.15 | 0.18 | −0.11 | −0.017 |
| Sum of contributions | +0.732 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.732 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/5/"><img src="https://rubric.hrih.si/badge/2026-10-28/5.svg" alt="Ranked #5 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 4 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenCausal conclusion
An unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens.
The article gives no link or citation for it.
The article says “an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens”
The source says No source to compare with.
Couldn’t checkVersion
Microsoft patched the Authenticator issue as CVE-2026-80097.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Microsoft has patched the issue as CVE-2026-80097”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
Couldn’t checkDate
Microsoft published CVE-2026-80097 on September 8, 2026.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “published CVE-2026-80097 on September 8, 2026”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
Couldn’t checkVersion
Versions of Microsoft Authenticator for Android before 6.2606.4246 are affected.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Versions before 6.2606.4246 are affected”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
Couldn’t checkNumber
CVE-2026-80097 is rated CVSS 8.6 (High) and classified as CWE-287 Improper Authentication.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CVSS: 8.6 (High) | CWE-287: Improper Authentication”
The source says No passage could be compared.
Source cited by the article: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
No source givenCausal conclusion
The exported AccountChooserActivity is gated only by getCallingActivity() != null, and the caller's identity was never used for any trust decision.
The article gives no link or citation for it.
The article says “The only gate on the activity is getCallingActivity() != null. Any app that calls startActivityForResult passes it”
The source says No source to compare with.
No source givenCausal conclusion
The isValidCallingApp signature check always passes because the impersonated app is installed and its genuine signature yields the genuine redirect URI.
The article gives no link or citation for it.
The article says “the impersonated app is installed on the device, so its genuine signature produces the genuine redirect URI”
The source says No source to compare with.
No source givenGeneralization
In the authors' tests, tokens obtained by impersonating Teams and requesting Graph gave full delegated mailbox, files and calendar access with no user interaction.
The article gives no link or citation for it.
The article says “In our tests the tokens gave full delegated mailbox, files and calendar access”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.