@azure/msal-node: authorization code flow may disclose auth parameters to attacker-controlled endpoint (CVE-2026-109461)
Severity: high · Patch status: patched · Since 2026-10-16 · CVE-2026-109461
Microsoft patched an origin validation error (CWE-346) in MSAL for Node.js, disclosed publicly on 2026-10-16 and reviewed 2026-10-23. In the authorization code flow, an unauthorized attacker can cause sensitive parameters to be disclosed to an attacker-controlled endpoint over a network, with high confidentiality impact and no integrity or availability impact. All versions from 5.0.0-beta.0 through before 7.1.0 are affected. No in-the-wild exploitation is known (EPSS 0.348%, 27th percentile). Version 7.1.0 contains the fix; as a workaround, applications should pass only the authcode to acquireTokenByCode. Given the library's wide use (84.8M monthly downloads, ~8,050 dependent repos), Node.js apps using MSAL auth code flow should upgrade promptly.
What to do
- Upgrade @azure/msal-node to 7.1.0 or later
- Until upgraded, ensure acquireTokenByCode is called with only the auth_code and no other sensitive parameters
- Audit apps using the auth_code flow for exposure of tokens or other parameters to redirect endpoints
- Check transitive npm dependencies for vulnerable msal-node versions
Fixed versions
Sources
All live incidents on Threat Watch
