CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
HighAC:H
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
HighC:H
Integrity
NoneI:N
Availability
NoneA:N
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Other
2 affected products
Microsoft Identity Client for NodeJS
Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems
What changed
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → No (MSRC assessment) · Exploitation detected: Not reported by MSRC → No known exploitation (MSRC assessment)
Affected products: Microsoft Edge (Chromium-based), Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems → Microsoft Identity Client for NodeJS, Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems
Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
Affected products: Microsoft Edge (Chromium-based) → Microsoft Edge (Chromium-based), Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems
Affected products: MessagePack 2.5.303 → Microsoft Edge (Chromium-based)
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
25 Oct 2026 · 19:05:13 UTCAffected productsMicrosoft Edge (Chromium-based), Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems → Microsoft Identity Client for NodeJS, Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems
17 Oct 2026 · 07:28:24 UTCAffected productsMicrosoft Edge (Chromium-based) → Microsoft Edge (Chromium-based), Microsoft Identity Client for NodeJS on Windows 10 Version 22H2 for x64-based Systems
CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.
cve-program · CVE-2026-109461
Published
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
### Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
### Patches
Version 7.1.0 and higher are patched.
### Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.