All vulnerabilities
CVE-2026-109461GHSA-xcx6-jx8p-x3h5

@azure/msal-node: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Microsoft @azure/msal-nodenpmContainers & cloud
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.1.0Fixed versionGitHub
Published16 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 7.1.0@azure/msal-node, npmGitHubnpm install @azure/msal-node@7.1.0
  • 7.1.0Microsoft Identity Client for NodeJSCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 2

2 outlets mention it. Reports are not confirmation; each links to its source.

Description

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the auth_code to to acquireTokenByCode

Text from GitHub Advisory Database

Affected versions 3

  • @azure/msal-node, npm>= 5.0.0-beta.0, < 7.1.0GitHub
  • Microsoft Identity Client for NodeJSaffected: 5.0.0 before 7.1.0CVE List
  • @azure/msal-node, npmfrom 5.0.0-beta.0, fixed in 7.1.0OSV

References 7