Vulnerability in Microsoft Identity Client for NodeJS

[ Description ]Official description

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

[ Fixes ]Fixes and patches

• Security bulletin: Microsoft CVE-2026-109461Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-109468Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-108452Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-80092Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092, cited by CERT-FR CERTFR-2026-AVI-1332

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1332

  Multiple vulnerabilities in Microsoft products Translated from French

  Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-109461CVE-2026-80092CVE-2026-108452+1 more CVEs

[ References ]References

• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461