CVE-2026-109461

ADVISORY - github

Summary

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the auth_code to to acquireTokenByCode

EPSS Score⁠: 0.00348 (0.272)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-346⁠

Origin Validation Error

ADVISORY - github

CWE-346⁠

Origin Validation Error

Impacted images

Advisories

NIST

CREATED

9 days ago

UPDATED

7 days ago

ADVISORY IDCVE-2026-109461⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-346⁠

CVSS SCORE

5.9medium

GitHub

CREATED

2 days ago

UPDATED

2 days ago

ADVISORY IDGHSA-xcx6-jx8p-x3h5⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-346⁠

CVSS SCORE

7.5high