SB20261110355 - Insufficiently protected credentials in Azure MSAL for Node.js

Description

This security bulletin contains information about 1 vulnerability.

1) Insufficiently protected credentials (CVE-ID: CVE-2026-108470)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain a user's access token and access data available under that user's existing permissions.

The vulnerability exists due to insufficient protection of credentials in Microsoft Authentication Library (MSAL) for Node.js when an affected client application connects to an attacker-controlled server. A remote attacker can convince a user to connect the application to that server to capture an access token intended for a different, protected service and use it to access the user's data.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108470
• https://www.npmjs.com/package/@azure/msal-node/v/7.0.1