PT-2026-122447

Published

2026-10-23

·

Updated

2026-10-23

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth code flow.

Patches

Version 7.1.0 and higher are patched.

Workarounds

Ensure you pass in only the auth code to to acquireTokenByCode
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-346: Origin Validation Error
Related identifiers
GHSA-XCX6-JX8P-X3H5
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com