{"id":"EUVD-2026-102952","enisaUuid":"45f6e644-c554-3d5d-b2b4-807288ae1cb1","description":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.","datePublished":"Oct 16, 2026, 5:11:24 PM","dateUpdated":"Oct 29, 2026, 3:21:43 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461\n","aliases":"CVE-2026-109461\nGHSA-xcx6-jx8p-x3h5\n","assigner":"microsoft","epss":0.36,"enisaIdProduct":[{"id":"f50d0d01-e4aa-3ff6-b343-c8228dcbb3f0","product":{"name":"Microsoft Identity Client for NodeJS","vendor":{"name":"Microsoft"}},"product_version":"5.0.0 \u003c7.1.0"}],"enisaIdVendor":[{"id":"8023bbfc-4ea0-3153-80bd-576235626d39","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"24dfef7b-12a2-3d1e-abdf-15e364bf0769","vulnerability":{"id":"GHSA-xcx6-jx8p-x3h5","description":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","datePublished":"Oct 23, 2026, 10:16:44 PM","dateUpdated":"Oct 23, 2026, 10:16:44 PM","baseScore":0.0,"references":"https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109461\nhttps://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901\nhttps://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e\nhttps://github.com/AzureAD/microsoft-authentication-library-for-js\nhttps://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461\n","enisa_id":"EUVD-2026-102952\n","aliases":"GHSA-xcx6-jx8p-x3h5\nCVE-2026-109461\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"73a688a1-25b6-356a-96a6-32a6e426ab85","vulnerability":{"id":"CVE-2026-109461","description":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.","datePublished":"Oct 16, 2026, 5:11:24 PM","dateUpdated":"Oct 29, 2026, 3:21:43 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461\n","enisa_id":"EUVD-2026-102952\n","assigner":"microsoft","epss":0.36,"dataProcessed":"Oct 30, 2026, 3:01:03 AM","vulnerabilityProduct":[{"id":"d5adedbd-eeb4-32be-8189-288cca66f1af","product":{"name":"Microsoft Identity Client for NodeJS","vendor":{"name":"Microsoft"}},"product_version":"5.0.0 \u003c7.1.0"}],"vulnerabilityVendor":[{"id":"253e3b06-ab1f-39e3-bf78-a593854f7f60","vendor":{"name":"Microsoft"}}]}}],"enisaIdAdvisory":[]}