CVE-2026-109461: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
References
- github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e
- github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901
- github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0
- github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5
- github.com/advisories/GHSA-xcx6-jx8p-x3h5
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461
- nvd.nist.gov/vuln/detail/CVE-2026-109461
Code Behaviors & Features
Detect and mitigate CVE-2026-109461 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →