Cross-site scripting in Microsoft Authentication Library for JavaScript - CVE-2026-108469

Vulnerability details

The vulnerability allows a remote attacker to spoof trusted content and potentially disclose or modify sensitive application data.

The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Authentication Library for JavaScript when rendering attacker-controlled content. A remote attacker can entice a victim to interact with crafted web content to execute scripts in the application's browser context, spoof trusted content, and potentially access or modify application data.

Successful exploitation requires the optional popup relay feature to be enabled and its relay page to be deployed without a Content Security Policy that blocks the attack. The attacker cannot configure these application settings.

Affected software

How to mitigate CVE-2026-108469

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108469
• https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/CHANGELOG.md#5210