CVE-2026-109461: Origin Validation Error in @azure/msal-node Leads to Information Disclosure

CVE-2026-109461 is an Origin Validation Error (CWE-346) in @azure/msal-node, the Microsoft Authentication Library for Node.js. The flaw specifically affects the ConfidentialClientApplication class in package versions starting from 5.0.0 up to but not including 7.1.0.

Confidential client applications run on secure servers and use sensitive credentials, such as client secrets, private key certificates, or federated identity assertions, to authenticate against Microsoft Entra ID (formerly Azure AD). The MSAL library incorporates instance-aware authentication options to dynamically resolve tenant endpoints and cloud instance routing, such as national cloud deployment hosts.

Due to insufficient origin validation and missing parameter sanitization in affected library releases, an attacker capable of manipulating response parameters can inject custom routing flags into token requests. This enables an attacker to force a confidential server-side application to route OAuth token requests—including client credentials—to an unauthorized host.

The root cause of this vulnerability lies in how ConfidentialClientApplication handled authorization code response payloads (authCodePayload) and extra query parameters passed into token acquisition methods. When processing authorization responses, the library forwarded raw parameter maps directly to the core base class handlers without enforcing validation or stripping non-essential fields.

Specifically, the acquireTokenByCode() method accepted an optional authCodePayload object containing key-value pairs derived from the authorization server redirect. In vulnerable versions, this object could include instance-aware host metadata override keys, such as cloud_instance_host_name, cloud_graph_host_name, or msgraph_host.

Because ConfidentialClientApplication failed to sanitize this structure, untrusted host metadata parameters were passed down to base authority resolution modules. Consequently, the library reconstructed token endpoints using caller-supplied host strings rather than restricting communication to pre-configured authority endpoints, introducing a credential reflection risk.

The fix was applied in commit f550958586475dbfeb1cd44be14a2d653728850e within pull request #8901. The maintainers implemented explicit checks against instanceAware configurations for confidential clients and introduced strict payload sanitization in acquireTokenByCode().

In ConfidentialClientApplication.ts, constructor-level enforcement was introduced to explicitly reject applications configured with instanceAware: true. Additionally, getAuthCodeUrl() was updated to throw a NodeAuthError if extraQueryParameters.instance_aware is provided.

// lib/msal-node/src/client/ConfidentialClientApplication.ts
 
constructor(configuration: Configuration) {
+   if (
+       "instanceAware" in configuration.auth &&
+       configuration.auth.instanceAware === true
+   ) {
+       throw NodeAuthError.createUnsupportedCcaInstanceAwareError();
+   }
 
    super(configuration);
}
 
public async acquireTokenByCode(
    request: AuthorizationCodeRequest,
    authCodePayload?: AuthorizationCodePayload
): Promise<AuthenticationResult> {
+   // Strictly extract permitted parameters and drop unvalidated routing metadata
+   const sanitizedAuthCodePayload = authCodePayload
+       ? {
+             code: request.code,
+             state: authCodePayload.state,
+             nonce: request.nonce,
+         }
+       : undefined;
 
+   return super.acquireTokenByCode(request, sanitizedAuthCodePayload);
}

The implementation drops all unexpected properties from authCodePayload, ensuring that injected cloud instance parameters cannot alter the destination endpoint during token exchanges.

To exploit this flaw, an attacker must influence the parameter payload supplied to acquireTokenByCode() or the initial request options supplied to getAuthCodeUrl(). This usually requires a scenario where authorization code responses or web query strings are parsed by an application and directly passed to MSAL methods without validation.

In a standard authorization code flow, the client application receives redirect parameters containing code and state. If the application passes an unvetted parameter map containing injected query parameters like cloud_instance_host_name=attacker.com, the library prior to version 7.1.0 parsed attacker.com as a valid authority target.

When acquireTokenByCode() completes the authorization code exchange, it issues an HTTP POST request containing client_secret or private key JWT assertions. If the authority target has been diverted, this HTTP request is transmitted directly to attacker.com, disclosing the server's confidential client credentials.

The vulnerability carries a CVSS v3.1 score of 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The High Confidentiality impact rating reflects the danger of disclosing confidential client credentials.

Successful compromise of confidential client credentials enables an attacker to impersonate the backend application within Microsoft Entra ID. Depending on the assigned application permissions (such as Microsoft Graph application permissions), an attacker could gain persistent, unauthorized access to organizational resources, user directories, or cloud services.

The Attack Complexity is rated High because successful exploitation requires specific client implementation conditions, such as passing unsanitized HTTP query parameters into MSAL invocation methods or the presence of parameter injection vectors in upstream authentication flows.

Organizations using @azure/msal-node should immediately upgrade to version 7.1.0 or higher to eliminate this origin validation flaw.

Package updates can be installed using npm or yarn:

npm install @azure/msal-node@^7.1.0

Additionally, developers should audit authorization handling code to ensure that application logic does not directly pass raw, unvalidated req.query objects into MSAL functions. Explicitly validating redirect parameters against expected schemas provides defense-in-depth.