CVE-2026-109461 ยท GHSA-xcx6-jx8p-x3h5
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
- Risk score
- 51/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
- Affected
- @azure/msal-node (npm) >= 5.0.0-beta.0, < 7.1.0
- Fix
- Upgrade @azure/msal-node to 7.1.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: azure, npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @azure/msal-node | npm | >= 5.0.0-beta.0, < 7.1.0 | 7.1.0 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461
- https://github.com/advisories/GHSA-xcx6-jx8p-x3h5
- https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
- https://nvd.nist.gov/vuln/detail/CVE-2026-109461
- https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
- https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
- https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
- https://github.com/advisories/GHSA-xcx6-jx8p-x3h5
Original description
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Last activity 23 Oct 2026. Patch Forecast updates every hour.