SB20261110354 - Cross-site scripting in Microsoft Authentication Library for JavaScript

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2026-108469)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to spoof trusted content and potentially disclose or modify sensitive application data.

The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Authentication Library for JavaScript when rendering attacker-controlled content. A remote attacker can entice a victim to interact with crafted web content to execute scripts in the application's browser context, spoof trusted content, and potentially access or modify application data.

Successful exploitation requires the optional popup relay feature to be enabled and its relay page to be deployed without a Content Security Policy that blocks the attack. The attacker cannot configure these application settings.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108469
• https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/CHANGELOG.md#5210