CVE-2026-109461: CVE-2026-109461: Origin Validation Error in @azure/msal-node Leads to Information Disclosure

#security #cve #cybersecurity

CVE-2026-109461: Origin Validation Error in @azure/msal-node Leads to Information Disclosure

Vulnerability ID: CVE-2026-109461
CVSS Score: 5.9
Published: 2026-10-23

An origin validation vulnerability in @azure/msal-node allows attackers to process unchecked authorization code response payloads or request query parameters in ConfidentialClientApplication, potentially directing sensitive client credentials to external endpoints.

TL;DR

Unchecked instance-aware parameters in @azure/msal-node ConfidentialClientApplication allow remote attackers to redirect token requests and expose confidential client authentication credentials to arbitrary hosts.

Technical Details

CWE ID: CWE-346 (Origin Validation Error)
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.9 (Medium)
EPSS Score: 0.00348 (27.14th percentile)
Impact: Information Disclosure (Confidential Client Credentials)
Exploit Status: None (No active public exploits reported)
CISA KEV Status: Not Listed

Affected Systems

Node.js applications using @azure/msal-node ConfidentialClientApplication
@azure/msal-node: >= 5.0.0, < 7.1.0 (Fixed in: 7.1.0)

Code Analysis

Commit: f550958

Fix instanceAware handling and sanitize authCodePayload parameters in msal-node ConfidentialClientApplication

--- a/lib/msal-node/src/client/ConfidentialClientApplication.ts
+++ b/lib/msal-node/src/client/ConfidentialClientApplication.ts
@@ -30,6 +30,12 @@ export class ConfidentialClientApplication {
 constructor(configuration: Configuration) {
+ if (
+ "instanceAware" in configuration.auth &&
+ configuration.auth.instanceAware === true
+ ) {
+ throw NodeAuthError.createUnsupportedCcaInstanceAwareError();
+ }
 super(configuration);
 }

Mitigation Strategies

Upgrade @azure/msal-node dependency to version 7.1.0 or higher.
Sanitize incoming authorization code response parameters prior to passing them into acquireTokenByCode().
Avoid configuring instanceAware options on ConfidentialClientApplication instances.
Implement strict parameter validation schemas for all authentication callback handlers.

Remediation Steps:

Update package.json to specify @azure/msal-node version ^7.1.0.
Run npm update @azure/msal-node or yarn upgrade @azure/msal-node.
Rebuild and deploy updated Node.js services.
Verify that ConfidentialClientApplication configurations do not pass instanceAware flags.

References

Read the full report for CVE-2026-109461 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community