CVE-2026-109461 Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
An origin validation error in MSAL for Node.js allows attackers to disclose sensitive information over the network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109461?
CVE-2026-109461 is a medium-severity vulnerability in Microsoft Identity Client for NodeJS, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Weakness: CWE-346
Which versions are affected by CVE-2026-109461?
2 open source packages ship an affected version, including @azure/msal-node.
| Package | Affected | Fixed in |
|---|---|---|
@azure/msal-node npm | From 5.0.0-beta.0 | 7.1.0 |
@azure/msal-node npm | From 5.0.0-beta.0 | 7.1.0 |
How do I fix CVE-2026-109461?
Upgrade @azure/msal-node to 7.1.0 or later.
Is CVE-2026-109461 being exploited?
There is no known exploitation of CVE-2026-109461 in the wild and no public exploit code.
Sources
Also known as GHSA-xcx6-jx8p-x3h5, ROOT-APP-NPM-CVE-2026-109461.