MSAL Node.js CVE-2026-109461

Exploitation targets the Microsoft Authentication Library (MSAL) for Node.js and abuses improper validation of a request's origin (CWE-346), permitting disclosure of sensitive information to an untrusted origin over the network. The CVSS vector indicates no authentication and no user interaction are required (PR:N/UI:N), but high attack complexity (AC:H) is the key limiting factor: successful exploitation depends on conditions outside the attacker's direct control - likely a race condition, a specific MSAL flow (e.g., cross-origin/redirect token acquisition), or an application that exposes MSAL responses across origins - rather than default behavior being trivially abusable. Impact is confined to confidentiality (C:H), with no integrity or availability effect. The specific MSAL feature, flow, or configuration that triggers the flaw is not detailed in the available description, so defenders should consult the MSRC advisory for exact affected versions and preconditions.

This is a moderate-priority confidentiality issue, not a drop-everything emergency. The CVSS 3.1 base score of 5.9 is driven by a network attack vector (AV:N) and no required privileges or user interaction (PR:N/UI:N), but is tempered by high attack complexity (AC:H), indicating the attacker must win a race condition or satisfy non-trivial preconditions rather than fire a simple one-shot request. Impact is confidentiality-only (C:H/I:N/A:N) - consistent with an origin-validation/information-disclosure flaw (CWE-346) that can leak sensitive data such as tokens or identity material. The temporal metrics materially lower real-world risk: Exploit Code Maturity is Unproven (E:U) and Remediation Level is Official Fix (RL:O), so there is no public exploit and a vendor patch exists. There is no CISA KEV listing and no EPSS score in the input, so exploitation probability cannot be quantified; the E:U flag and absence of KEV together suggest no known active exploitation at time of analysis. Overall this reads as a genuine but lower-tier network info-disclosure bug whose AC:H and patched status should place it below unauthenticated RCEs or KEV-listed items in a remediation queue, while still warranting patching given PR:N on a widely-used authentication library.

An unauthenticated remote attacker positioned to interact with or coerce requests against a Node.js application using MSAL exploits the origin validation weakness to have the library accept or respond to a request from an untrusted origin, causing sensitive authentication-related information to be disclosed. Because attack complexity is high (AC:H), the attacker likely must satisfy specific timing or contextual conditions to succeed. No public exploit code is known (E:U), so an attacker would need to develop their own technique.