## MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

- 種別: advisory
- 重大度: high
- 関連技術: nodejs, azure
- CVE: CVE-2026-109461
- 公開日時: 2026-10-23T22:16:44.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xcx6-jx8p-x3h5)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xcx6-jx8p-x3h5

影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode