{"id":"CVE-2026-109461","kind":"vulnerability","aliases":["CVE-2026-109461","GHSA-xcx6-jx8p-x3h5"],"related":[],"title":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","description":"### Impact\n\nOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.\n\n### Patches\n\nVersion 7.1.0 and higher are patched.\n\n### Workarounds\n\nEnsure you pass in only the auth_code to to acquireTokenByCode","summary":"The Microsoft Authentication Library for Node.js (@azure/msal-node) has an origin validation error in its authorization code flow. An unauthorized network attacker can receive information sent during the token exchange, such as authorization parameters.","severity":"high","cvss":7.5,"epss":0.00348,"exploited":false,"exploited_at":null,"products":[{"name":"@azure/msal-node","fixed":["7.1.0"],"affected":">= 5.0.0-beta.0, < 7.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["authentication","azure","cwe-346","msal","node","npm","package"],"not_affected_if":["no-auth-code-flow","version-7.1.0-or-later"],"how_to_check":"- Run `npm ls @azure/msal-node` and look for any version from `5.0.0-beta.0` up to but not including `7.1.0`\n- Search lockfiles for `@azure/msal-node` and check the resolved version","fix":"- Upgrade `@azure/msal-node` to `7.1.0` or higher\n- Until upgraded, pass only the auth_code to `acquireTokenByCode`, per the advisory workaround","status":"open","published_at":"2026-10-16T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:24:58+00:00","updated_at":"2026-10-25T03:24:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:24:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@azure/msal-node` to `7.1.0` or higher\n- Until upgraded, pass only the auth_code to `acquireTokenByCode`, per the advisory workaround","reach":"network","title":"MSAL Node: authorization code flow can leak parameters to attacker endpoint","impact":"medium","summary":"The Microsoft Authentication Library for Node.js (@azure/msal-node) has an origin validation error in its authorization code flow. An unauthorized network attacker can receive information sent during the token exchange, such as authorization parameters.","category":"package","nicknames":[],"who_cares":["node","azure","msal","authentication","npm"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Authorization parameters sent to an attacker-controlled endpoint are disclosed","analyst_note":"Confirm which parameters are disclosed and whether an attacker must control a redirect or endpoint; see the GHSA-xcx6-jx8p-x3h5 advisory.","how_to_check":"- Run `npm ls @azure/msal-node` and look for any version from `5.0.0-beta.0` up to but not including `7.1.0`\n- Search lockfiles for `@azure/msal-node` and check the resolved version","needs_analyst":true,"not_affected_if":["no-auth-code-flow","version-7.1.0-or-later"],"who_is_affected":"Applications that use @azure/msal-node's authorization code flow through acquireTokenByCode in versions from 5.0.0-beta.0 up to 7.1.0. The sources do not say which deployment setups make the leak reachable beyond use of this flow. Apps that do not use the authorization code flow or do not call acquireTokenByCode can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3441,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109461':17A,25A '-2026':16A,24A '-346':30B '7.1.0':97C 'acquiretokenbycod':113C 'affect':90C 'allow':79C 'attack':12A,55B,82C 'attacker-control':11A 'auth':92C,109C 'authent':27B,37B,74C 'author':3A,49B,66B 'azur':28B 'azure/msal-node':26A,41B 'code':4A,50B,93C,110C 'control':13A 'cve':15A,23A 'cwe':29B 'disclos':7A,84C 'endpoint':14A 'ensur':103C 'error':46B,71C 'exchang':63B 'flow':5A,51B,94C 'ghsa':19A 'ghsa-xcx6-jx8p-x3h5':18A 'higher':99C 'impact':68C 'inform':58B,85C 'jx8p':21A 'librari':38B,75C 'may':6A 'microsoft':36B,73C 'msal':1A,31B,76C 'network':54B,88C 'node':2A,32B 'node.js':40B,78C 'npm':33B 'origin':44B,69C 'packag':34B 'paramet':8A,67B 'pass':105C 'patch':95C,101C 'receiv':57B 'sent':59B 'token':62B 'unauthor':53B,81C 'valid':45B,70C 'version':96C 'workaround':102C 'x3h5':22A 'xcx6':20A","nicknames":[],"mitigations":[],"who_affected":"Applications that use @azure/msal-node's authorization code flow through acquireTokenByCode in versions from 5.0.0-beta.0 up to 7.1.0. The sources do not say which deployment setups make the leak reachable beyond use of this flow. Apps that do not use the authorization code flow or do not call acquireTokenByCode can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109461","severity":null,"published_at":"2026-10-16T18:17:31+00:00","modified_at":"2026-10-18T12:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"ghsa","external_id":"GHSA-xcx6-jx8p-x3h5","url":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","severity":"high","published_at":"2026-10-23T22:16:44+00:00","modified_at":"2026-10-23T22:16:45+00:00","first_seen_at":"2026-10-23T22:22:36+00:00","fetched_at":"2026-10-23T22:22:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}