Researcher Ofek Levin says an app with no Android permissions could exploit Microsoft Authenticator's broker to obtain delegated work-account tokens; Microsoft patched the bug before publication.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [x.com](https://x.com/EnclaveAI/status/2114356312368623761)
Why it matters #
The flaw shows how a trusted authentication broker can expose broad work-account access when it validates an app's claimed identity instead of the real caller. Microsoft patched the reported issue before Enclave's public disclosure.
Enclave disclosed a flaw in Microsoft Authenticator for Android that let a malicious app with zero Android permissions impersonate Microsoft Teams and obtain delegated tokens for a signed-in work account. The company's technical report, published October 23rd, says the tokens it obtained in tests could access Microsoft Graph services including email, files and calendars. Microsoft patched the issue before the report appeared.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.