CVE-2026-109461
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
- Record
CVE-2026-109461- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2026-102952
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
- Record
EUVD-2026-102952- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcx6-jx8p-x3h5
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
Patches
Version 7.1.0 and higher are patched.
Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
- Record
GHSA-xcx6-jx8p-x3h5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
- Record
CVE-2026-109461- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVGHSA-xcx6-jx8p-x3h5
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
Patches
Version 7.1.0 and higher are patched.
Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
- Record
GHSA-xcx6-jx8p-x3h5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-109461 No score
CVE-2026-109461 in @azure/msal-node - Patched by Root
Root has patched CVE-2026-109461 in the @azure/msal-node package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-109461- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@azure/msal-nodenpm |
5.0.0-beta.0 up to 7.1.0 | 7.1.0 |
@azure/msal-nodeRoot:npm |
before 5.6.0-aikido.1 | 5.6.0-aikido.15.1.5-aikido.1 |
@rootio/azure__msal-nodeRoot:npm |
before 5.6.0-root.io.1 | 5.6.0-root.io.15.1.5-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-109461 is a medium vulnerability (CVSS 5.9) in Microsoft Identity Client For Nodejs, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in @azure/msal-node 7.1.0.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461
github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
nvd.nist.gov/vuln/detail/CVE-2026-109461