{"id":"ghsa-ghsa-xcx6-jx8p-x3h5","seq":661288,"kind":"advisory","title":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","url":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xcx6-jx8p-x3h5","summary":"影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0\nOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode","severity":"high","techs":["nodejs","azure"],"cves":["CVE-2026-109461"],"tags":["GHSA-xcx6-jx8p-x3h5","@azure/msal-node"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:16:44.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}