Enclave details patched Authenticator flaw that let Android apps impersonate Teams

Security firm Enclave disclosed on October 23 that a flaw in Microsoft Authenticator for Android allowed a malicious app with zero Android permissions to impersonate Microsoft Teams and obtain delegated tokens for a signed-in work account, with test tokens reaching Microsoft Graph services including email, files and calendars. Researcher Ofek Levin detailed the issue, and Microsoft patched the bug before Enclave's public report appeared. The flaw shows how a trusted authentication broker can expose broad work-account access when it validates an app's claimed identity instead of the real caller.

Enclave details patched Authenticator flaw that let Android apps impersonate Teams Researcher Ofek Levin says an app with no Android permissions could exploit Microsoft Authenticator's broker to obtain delegated work-account tokens; Microsoft patched the bug before publication. By Ryan Merket https://runtimewire.com/author/ryan-merket · Published Primary source: x.com https://x.com/EnclaveAI/status/2114356312368623761 Why it matters The flaw shows how a trusted authentication broker can expose broad work-account access when it validates an app's claimed identity instead of the real caller. Microsoft patched the reported issue before Enclave's public disclosure. Enclave https://enclave.ai/ disclosed a flaw in Microsoft Authenticator for Android that let a malicious app with zero Android permissions impersonate Microsoft Teams and obtain delegated tokens for a signed-in work account. The company's technical report, published October 23rd https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens , says the tokens it obtained in tests could access Microsoft Graph services including email, files and calendars. Microsoft patched the issue before the report appeared.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.