Live › vulnerability › CVE-2026-109461
Go to dashboardThe Microsoft Authentication Library for Node.js (@azure/msal-node) has an origin validation error in its authorization code flow. An unauthorized network attacker can receive information sent during the token exchange, such as authorization parameters.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use @azure/msal-node's authorization code flow through acquireTokenByCode in versions from 5.0.0-beta.0 up to 7.1.0. The sources do not say which deployment setups make the leak reachable beyond use of this flow. Apps that do not use the authorization code flow or do not call acquireTokenByCode can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @azure/msal-node | npm | >= 5.0.0-beta.0, < 7.1.0 | 7.1.0 |
npm ls @azure/msal-node and look for any version from 5.0.0-beta.0 up to but not including 7.1.0@azure/msal-node and check the resolved version@azure/msal-node to 7.1.0 or higheracquireTokenByCode, per the advisory workaroundEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
Version 7.1.0 and higher are patched.
Ensure you pass in only the auth_code to to acquireTokenByCode
This page as .md · .json · in your agent: get_signal("CVE-2026-109461")
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.