CVE-2026-109461: Medium severity Microsoft Identity Client for NodeJS vulnerability
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Other sources
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.0
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is exploitable over a network and does not require privileges or user interaction. Exploitation is rated as high complexity.
What is the potential impact if exploitation succeeds?
Successful exploitation may disclose information. The supplied metrics indicate high confidentiality impact, with no integrity or availability impact.
How certain is the reported severity assessment?
The vulnerability is rated medium severity with a CVSS score of 5.9. The report lists confirmed report confidence and an official remediation level.