AuthMask: Microsoft Authenticator hands tokens to an app with zero permissions
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Enclave researchers report that an Android app with no permissions could get Microsoft Authenticator to return tokens for a signed-in work account. The exported AccountChooserActivity trusted caller-supplied data, and its signature check compared values the caller could build from the installed target app. Posing as Teams and requesting Graph, they obtained mail, files and calendar scopes. Microsoft reportedly fixed it as CVE-2026-80097 (CVSS 8.6) in version 6.2606.4246. The findings and patch details are unverified. Builders of brokers should authenticate the actual caller.