CVE-2026-109461

Summary

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Severity

high

CVSS

7.5

EPSS

0.4% (p30)

CWE

CWE-346

Also known as

GHSA-xcx6-jx8p-x3h5

Published

2026-10-23

Updated

2026-10-23

Advisory details

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the auth_code to to acquireTokenByCode

References

• https://github.com/advisories/GHSA-xcx6-jx8p-x3h5
• https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
• https://nvd.nist.gov/vuln/detail/CVE-2026-109461
• https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
• https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
• https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461

Related advisories

• CVE-2026-77363 — critical · npm/obsidian-tc
• CVE-2026-114125 — critical · npm/storybook
• CVE-2026-108261 — critical · npm/tinacms
• CVE-2026-103922 — critical · npm/@capacitor/android
• CVE-2026-61742 — critical · npm/@bytebase/dbhub
• CVE-2026-59971 — critical · PyPI/mysql-mcp-server
• CVE-2026-54069 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-108372 — high · PyPI/loopx

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity