CVE-2026-109461

About vulnerability

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the auth_code to to acquireTokenByCode

Affected product:

adk-js , agents-for-js , applicationinsights-node.js , azure-sdk-for-js , botbuilder-js , celo-celocli , celo-wallet-hsm-azure , chat-adapter-teams , confluent-kafka-javascript , ecosystem , effect-sql-mssql , google-adk , mastra , mastra-connect , mastra-teams , mem0-openclaw-mem0 , mem0ai , microsoft-365-agents-toolkit , microsoft-authentication-library-for-js , microsoft-rush , microsoft-rush-lib , mikro-orm-mssql , node-mssql , office-addin-debugging , office-addin-dev-settings , redis-entraid , reown-appkit , reown-appkit-controllers , reown-appkit-scaffold-ui , reown-appkit-ui , reown-appkit-utils , rushstack , rushstack-heft-vscode-extension-plugin , rushstack-heft-vscode-extension-rig , rushstack-lockfile-explorer , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-cli-client , sdk-typescript , teams.ts , tedious , temporalio-google-adk-agents , unstorage , vscode-vsce , wallet-adapter , walletconnect-core , walletconnect-monorepo , walletconnect-sign-client , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , walletconnect-utils-scoped

Affected packages:

@azure/msal-node @ 5.6.0 (+356 more)