MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode

GitHub Advisory Databaseで読む

2026/10/24 07:16、GitHub Advisory Databaseが「MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js、Microsoft Azure。CVE: CVE-2026-109461。