GHSA-xcx6-jx8p-x3h5: High severity npm/@azure/msal-node vulnerability

Q: Which applications are exposed to this issue?

Applications using npm/@azure/msal-node in the auth_code flow are affected if they use a version earlier than 7.1.0. The issue can be exploited over a network without authentication or user interaction.

Q: What is required to exploit the vulnerability?

An attacker needs to target the origin-validation error in the authorization-code flow. The available information indicates no privileges or user interaction are required, and the impact is disclosure of information rather than modification or service disruption.

Q: What can be done if upgrading is not immediately possible?

Ensure that only the authorization code itself is passed to acquireTokenByCode. Do not pass additional values in place of, or alongside, the auth_code input.

Q: How can I remediate the issue?

Upgrade npm/@azure/msal-node to version 7.1.0 or later, which contains the patch.

Published Oct 23, 2026

Updated

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the authcode to to acquireTokenByCode

Affected Software

1 affected componentFixes available

npm/@azure/msal-node>=5.0.0-beta.0<7.1.0

7.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@azure/msal-node to a version that resolves this vulnerability.
Fixed in 7.1.0
Upgrade
Upgrade Microsoft Authentication Library (MSAL) for Node.js to a version that resolves this vulnerability.
Fixed in 7.1.0
Configuration
Pass only the auth_code to acquireTokenByCode.
Microsoft Authentication Library (MSAL) for Node.js acquireTokenByCode input = auth_code only

Event History

Oct 23, 2026

Advisory Published

via GitHub·10:16 PM

Data Sourced

via GitHub·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using npm/@azure/msal-node in the auth_code flow are affected if they use a version earlier than 7.1.0. The issue can be exploited over a network without authentication or user interaction.

What is required to exploit the vulnerability?

An attacker needs to target the origin-validation error in the authorization-code flow. The available information indicates no privileges or user interaction are required, and the impact is disclosure of information rather than modification or service disruption.

What can be done if upgrading is not immediately possible?

Ensure that only the authorization code itself is passed to acquireTokenByCode. Do not pass additional values in place of, or alongside, the auth_code input.

How can I remediate the issue?

Upgrade npm/@azure/msal-node to version 7.1.0 or later, which contains the patch.

GHSA-xcx6-jx8p-x3h5: High severity npm/@azure/msal-node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What is required to exploit the vulnerability?

What can be done if upgrading is not immediately possible?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What is required to exploit the vulnerability?

What can be done if upgrading is not immediately possible?

How can I remediate the issue?