Zero Radar
← feed
HighVulnerabilityCVE-2026-109461updated 25 Oct 2026, 13:32 UTC

Microsoft login library for Node.js can leak information over the network

A flaw in the library that handles Microsoft sign-in for Node.js apps can let an outside attacker see data it should keep private. Updating the library closes the gap.

Fixed in @azure/msal-node 7.1.0 and higherOfficial source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@azure/msal-node 7.1.0 and higher · since 25 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

An origin validation error in @azure/msal-node's auth_code flow allows an unauthorized attacker to disclose information over the network.

Why it is dangerous: An attacker who can reach the affected app over the network may be able to read information meant only for legitimate users during sign-in. Apps using Microsoft authentication through this library are at risk.

Are you affected?

You are affected if your Node.js app uses @azure/msal-node version 5.0.0-beta.0 up to (but not including) 7.1.0 with the auth_code flow.

Package / productAffected versionsFixed in
@azure/msal-node · npm>= 5.0.0-beta.0, < 7.1.07.1.0

What to do

  1. Update @azure/msal-node to 7.1.0 or later
  2. Check your lockfile and dependency tree to confirm no older copy remains
  3. Until updated, pass only the auth_code to acquireTokenByCode as a workaround

Timeline

  1. 23 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 23 Oct 2026, 22:16 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109461 · GHSA-xcx6-jx8p-x3h5
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 22:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Microsoft login library for Node.js can leak information over the network · Zero Radar