rootpwn

medium · CVSS v3 5.9

CVE-2026-109461

Microsoft Authentication Library (MSAL) for Node.js contains an origin validation flaw that can allow an attacker to read sensitive data ove

Overview

Microsoft Authentication Library (MSAL) for Node.js contains an origin validation flaw that can allow an attacker to read sensitive data over the network. The issue is limited to applications that rely on MSAL for authentication and does not provide direct code execution. It is a medium‑severity vulnerability with a CVSS score of 5.9.

Description

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

Impact

The flaw primarily affects confidentiality, enabling unauthorized disclosure of authentication tokens or user data. Developers and organizations using MSAL in their Node.js applications are at risk of leaking sensitive information to external actors.

Remediation

Update MSAL Node.js to the latest patched version released by Microsoft. Verify that origin validation is correctly configured and enforce strict CORS policies. Monitor network traffic for anomalous requests and apply any vendor‑issued hotfixes promptly.

Risk context

The vulnerability is rated medium severity (CVSS 5.9) with no EPSS data available, indicating a moderate but non‑critical risk that should be addressed in a timely manner.

Affected products

  • Microsoft MSAL Node.js
  • Microsoft Authentication Library

Scores

Severity
medium
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
—
EPSS
—

MSAL Node.js origin-validation information-disclosure Microsoft authentication medium

← All CVEs

Related CVEs

medium

CVE-2026-109368

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to sensitive information exposure via the 'id' parameter. Authenticated users with subscriber-level access can retrieve private booking descriptions and IDs from any calendar. This flaw allows attackers to access confidential booking data on affected sites.

View analysis

medium

CVE-2026-111601

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.

View analysis

medium

CVE-2026-92978

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.

View analysis

medium

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

View analysis