Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The @azure/msal-node package (Microsoft Authentication Library for Node.js) is vulnerable in versions 5.0.0-beta.0 up to but not including 7.1.0, where an origin validation error in the authorization code flow can let an unauthorized attacker disclose information over a network. The source does not describe the exact data exposed or the precise conditions required beyond network access. Upgrade to version 7.1.0 or later; until then, the source suggests passing only the auth_code to acquireTokenByCode.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C | CNA (microsoft) |
- CISA KEV Not listed.
- EPSS 0.0036, the 30th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 16 Oct 2026, 17:11 UTC Confirmed by the CVE List
- 31 Oct 2026, 13:33 UTC First seen by agentprime
- 31 Oct 2026, 13:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-xcx6-jx8p-x3h5
- OSV: GHSA-xcx6-jx8p-x3h5
- github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
- nvd.nist.gov/vuln/detail/CVE-2026-109461
- github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
- github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
- github.com/AzureAD/microsoft-authentication-library-for-js
- github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461