MSAL for Node.js CVE-2026-84003

Exploitation requires the attacker to achieve a network-intercept position capable of capturing a live MSAL authentication token from a Node.js application - for example, man-in-the-middle on a shared network segment, rogue Wi-Fi AP, or DNS/BGP hijack. The target application must be running a vulnerable @azure/msal-node version (1.0.0 - <5.6.0). No authentication or prior access to the target system is required (PR:N). No user interaction is required beyond the legitimate user's normal authentication activity. Exploitation is limited by AC:H: the attacker cannot simply send a crafted packet from the open internet; they must first obtain a valid captured token from an active session. TLS enforcement on authentication channels further raises the bar, though misconfigurations or cert-validation flaws could lower it.

The CVSS 3.1 score of 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately reflects the risk profile: exploitation is remotely feasible but requires a network-intercept position (AC:H), which substantially limits the attacker pool. The C:H/I:H impacts are credible - successful identity spoofing grants the attacker full access to any resource the victim identity can reach. No CISA KEV listing and no public POC are noted, suggesting this is not currently subject to widespread opportunistic exploitation. EPSS data was not provided. The combination of AC:H and no known active exploitation suggests this is a medium-urgency patch target for defenders, elevated by the breadth of Microsoft Identity-integrated Node.js deployments in enterprise environments.

An attacker with a man-in-the-middle position on the network path between a Node.js application and the Microsoft Identity Platform endpoint - achieved via ARP spoofing on a shared segment, a rogue access point, or DNS manipulation - captures a raw authentication token from a legitimate user's session. The attacker then replays that token directly against the target service or API, impersonating the victim and gaining access to their protected resources without possessing their credentials.