Microsoft Authentication Library for Node.js: Information disclosure via origin validation error (CVE-2026-109461)

CVE-2026-109461 is an origin validation error in the Microsoft Authentication Library (MSAL) for Node.js. The vulnerability exists within the library's authorization code flow, where improper verification of the communication source allows an unauthorized attacker to potentially disclose sensitive parameters to an attacker-controlled endpoint. The issue affects versions starting from 5.0.0-beta.0 up to, but not including, 7.1.0.

Impact

Successful exploitation allows for the disclosure of sensitive information transmitted during the authorization code flow. The confidentiality of tokens or authorization parameters may be compromised if an attacker can induce the library to send data to an unauthorized endpoint.

Recommendation

• Upgrade the @azure/msal-node package to version 7.1.0 or higher immediately.
• As a temporary mitigation, ensure that only the auth_code is passed to the acquireTokenByCode function in the application logic.
• Audit applications utilizing MSAL Node for authorization code flows to identify potential exposure points where the validation logic may be bypassed.