October 31, 2026, 10:02 am | Read time: 2 minutes
The Microsoft Authenticator can be used to add an extra layer of security to accounts. However, the Android version of the app was itself a security issue for some time. Researchers at the security firm Enclave discovered a vulnerability that allowed manipulated apps to obtain access tokens. The attack did not even require special permissions on the smartphone.
The security firm “Enclave” calls the attack “AuthMask.” The cause lay in how the Microsoft Authenticator verified the identity of other apps. Simply put, it checked whether the transmitted data matched an expected application. However, it did not sufficiently ensure that the request actually came from the genuine app.
The researchers demonstrated this with a fake Microsoft Teams app. It provided the Authenticator with the package name, client ID, and redirect URI, among other things. The Authenticator then determined the signature of the real installed Teams package and calculated a matching redirect URI from it.
Why the Verification Was Insufficient
This was precisely where the problem lay. The Authenticator compared the calculated address with the information from the manipulated application. If it could provide the expected information, the Authenticator accepted the request. As a result, an access token could end up with the wrong app. Deceptively realistic app copies pose a serious threat to online security. Especially with Microsoft accounts used for work, stolen access tokens can represent a significant risk.
Also of interest: WhatsApp is set to check calls for you in the future
Update for Android Is Available
Microsoft has since fixed the vulnerability. From Authenticator version 6.2606.4246, the issue is supposed to be resolved. Anyone using an older version on Android should therefore install an update. Whether the iOS version was also affected by the vulnerability is currently unknown.