{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftmicrosoft_authentication_library_for_node.jsnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:microsoft_authentication_library_for_node.js:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-109461"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["msal-node (\u003e= 5.0.0-beta.0, \u003c 7.1.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cloud","web-application","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2026-109461 is an origin validation error in the Microsoft Authentication Library (MSAL) for Node.js. The vulnerability exists within the library's authorization code flow, where improper verification of the communication source allows an unauthorized attacker to potentially disclose sensitive parameters to an attacker-controlled endpoint. The issue affects versions starting from 5.0.0-beta.0 up to, but not including, 7.1.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the disclosure of sensitive information transmitted during the authorization code flow. The confidentiality of tokens or authorization parameters may be compromised if an attacker can induce the library to send data to an unauthorized endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003e@azure/msal-node\u003c/code\u003e package to version 7.1.0 or higher immediately.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, ensure that only the \u003ccode\u003eauth_code\u003c/code\u003e is passed to the \u003ccode\u003eacquireTokenByCode\u003c/code\u003e function in the application logic.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing MSAL Node for authorization code flows to identify potential exposure points where the validation logic may be bypassed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T15:55:02Z","date_published":"2026-10-24T15:55:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-msal-node-auth-disclosure/","summary":"An origin validation error in the msal-node library allows an attacker to intercept sensitive parameters during the authorization code flow, potentially leading to unauthorized information disclosure.","title":"Microsoft Authentication Library for Node.js: Information disclosure via origin validation error (CVE-2026-109461)","url":"https://feed.craftedsignal.io/briefs/2026-10-msal-node-auth-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:microsoft_authentication_library_for_node.js:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}