MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode
| CVE | CVE-2026-109461 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 07:16, GitHub Advisory Database에서 "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js, Microsoft Azure. CVE: CVE-2026-109461.