Insufficiently protected credentials in Azure MSAL for Node.js - CVE-2026-108470
Published: November 10, 2026
Vulnerability identifier: #VU164726
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108470
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain a user's access token and access data available under that user's existing permissions.
The vulnerability exists due to insufficient protection of credentials in Microsoft Authentication Library (MSAL) for Node.js when an affected client application connects to an attacker-controlled server. A remote attacker can convince a user to connect the application to that server to capture an access token intended for a different, protected service and use it to access the user's data.
Affected software
Azure MSAL for Node.js
How to mitigate CVE-2026-108470
Install security update from vendor's website.
Azure MSAL for Node.js - update to 7.0.1