Origin validation error in MSAL for Node.js discloses information
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
Microsoft Authentication Library (MSAL) for Node.js, from 5.0.0 before 7.1.0 and @azure/msal-node from 5.0.0-beta.0 before 7.1.0, contains an origin validation error (CWE-346). An unauthorized attacker on the network can disclose information. The CVSS 3.1 base score is 5.9 (MEDIUM), with high confidentiality impact and no integrity or availability impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Identity Client for NodeJS | 5.0.0 to before 7.1.0 | 7.1.0 | Patch available | CNA |
| — | @azure/msal-node (npm) | 5.0.0-beta.0 to before 7.1.0 | 7.1.0 | Patch available | GHSA-xcx6-jx8p-x3h5 |
- Microsoft Identity Client for NodeJS VendorMicrosoft Affected 5.0.0 to before 7.1.0 Fixed in 7.1.0 Patch available CNA
- @azure/msal-node (npm) Vendor— Affected 5.0.0-beta.0 to before 7.1.0 Fixed in 7.1.0 Patch available GHSA-xcx6-jx8p-x3h5
Remediation
Update Microsoft Identity Client for NodeJS to version 7.1.0 or later. Update @azure/msal-node to version 7.1.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Microsoft Identity Client for NodeJS (Microsoft) Fixed in 7.1.0
- Fix · GHSA-xcx6-jx8p-x3h5 @azure/msal-node (npm) Fixed in 7.1.0 Advisory →
Timeline
- 2026-10-16 Threatist record created from CVE-2026-109461
- 2026-10-18 Affected versions changed · CNA
- 2026-10-18 CISA SSVC decision points changed
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-23 Alias added: GHSA-xcx6-jx8p-x3h5
- 2026-10-23 Fix available: npm/@azure/[email protected] · GHSA-xcx6-jx8p-x3h5
- 2026-10-23 CVSS score added · GHSA-xcx6-jx8p-x3h5
- 2026-10-23 Weakness changed · GHSA-xcx6-jx8p-x3h5
- 2026-10-23 7 new references · GHSA-xcx6-jx8p-x3h5
References
Other 5
- https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
- https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
- https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
- https://github.com/AzureAD/microsoft-authentication-library-for-js
- https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
More Microsoft vulnerabilities
- TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-109461 · CVE Program
- CVE-2026-109461 · NVD
- FIRST EPSS
- GHSA-xcx6-jx8p-x3h5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences