CVE-2026-109461
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. The vulnerability concerns the origin verification process in the MSAL library.
Risk Assessment
An unauthorized attacker could obtain sensitive information transmitted over the network, potentially leading to leakage of authentication data or other sensitive information. The risk affects Node.js applications using MSAL for authentication.
Recommendation
Upgrade Microsoft Authentication Library (MSAL) for Node.js to the latest version as soon as a fix is available, and verify the origin validation configuration in applications using MSAL. Consider monitoring for unusual network traffic related to authentication.
Other vulnerabilities in Microsoft Authentication Library (MSAL) for Node.js
Original NVD description (English source)
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS