Abstract:
Cyber security researcher Aoife Craven recently released a report disclosing the AuthMask attack chain: malicious Android applications can use the authentication proxy of Microsoft Authenticator to impersonate installed Microsoft applications to obtain account tokens. The vulnerability is numbered CVE-2026-80097. Security researchers have notified Microsoft in advance to fix it, and Microsoft released an update to fix the vulnerability in September.
Microsoft Authenticator can be used only as a TOTP authenticator, which generates a 6-digit dynamic verification code. However, Microsoft Authenticator also provides authentication proxy services for Microsoft applications, that is, users can log in to corporate accounts to obtain Microsoft 365 resources after being confirmed by the authenticator.
The problem lies in the components that Microsoft opens for other applications to call. Research has found that the calling application can fill in the application name, package name, client ID and redirection address in the request. The authenticator checks the redirect address against the application identity claimed by the request, but does not complete the authorization determination using the application identity that actually made the call.
For example, a malicious application can claim to be Microsoft Teams that is already installed on the device. Since the signature and redirect address of the application do exist on the device, Microsoft Authenticator will accept this disguise and finally return the real token to the application that actually initiated the request.
Security researchers tested various application identity disguises, taking Microsoft Teams as an example. After disguise, they obtained Microsoft Graph delegated permissions, including reading and sending emails, accessing files, modifying calendars, sending Microsoft Teams messages, and operating SharePoint content. Access tokens can also directly access corresponding resources, and refresh tokens can also be exchanged for new access tokens within the validity period.
According to research, attackers who exploit the flaw can also manage users' authentication methods, create and delete pass keys, which makes the risk not only related to data reading, but also may involve the login security settings of the account itself.
After discovering the vulnerability, researchers have responsibly reported it to Microsoft. The main affected ones are the Android version of Microsoft Authenticator 6.0.0~6.2606.4246. Microsoft released version 6.2606.4246 on September 8 to fix the problem.
In order to prevent some users from not upgrading to the new version for a long time, the researchers did not publish the details of the vulnerability after the vulnerability was fixed. Now, 50 days have passed before the researchers announced the vulnerability. It is estimated that attackers will use the relevant flaws to find attack opportunities.
Comments