Microsoft Identity Client For Nodejs
Monthly
Information disclosure in Microsoft Authentication Library (MSAL) for Node.js can expose sensitive data to an untrusted origin due to improper origin validation (CWE-346). The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) allows unauthenticated remote exploitation without user interaction, but high attack complexity means success depends on specific MSAL flows or cross-origin conditions rather than default behavior. No public exploit identified at time of analysis; a vendor patch is available through the Microsoft MSRC update guide.
Information disclosure in Microsoft Authentication Library (MSAL) for Node.js can expose sensitive data to an untrusted origin due to improper origin validation (CWE-346). The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) allows unauthenticated remote exploitation without user interaction, but high attack complexity means success depends on specific MSAL flows or cross-origin conditions rather than default behavior. No public exploit identified at time of analysis; a vendor patch is available through the Microsoft MSRC update guide.