MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109461 · GHSA-xcx6-jx8p-x3h5 · EUVD-2026-102952 · published 16 Oct 2026
How serious is it
- Severity: high, CVSS score 7.5 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-109461?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
@azure/msal-node(npm) >= 5.0.0-beta.0, < 7.1.0
How to check
- Run
npm ls @azure/msal-nodein your project to see the installed version, including copies pulled in by other packages. - Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
- Or run
npx shippable-dev scan localhost:3000in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.
How to fix
Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
- Upgrade
@azure/msal-nodeto 7.1.0 or later, commit the lockfile and redeploy. - If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
### Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
### Patches
Version 7.1.0 and higher are patched.
### Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461
- github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
- nvd.nist.gov/vuln/detail/CVE-2026-109461
- github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
- github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
- github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
- github.com/advisories/GHSA-xcx6-jx8p-x3h5
Merged from CVE List, GitHub Advisory Database, ENISA EUVD. Last updated 24 Oct 2026. All vulnerabilities · RSS · JSON