Go to packages list

azure-msal-node

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)

0CriticalAffects 0 versions
1HighAffects 1 version
0MediumAffects 0 versions
1ModerateAffects 1 version
0LowAffects 0 versions

Severity distribution (all time)

2vulnerabilities

Critical0 (0.0%)
High1 (50.0%)
Medium0 (0.0%)
Moderate1 (50.0%)
Low0 (0.0%)

Monthly breakdown

Critical
High
Medium
Moderate
Low

Oct 20261 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Jun 20241 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0

Vulnerabilities (2)

Known vulnerabilities affecting azure-msal-node, based on data from OSV.

Filter by severitySort by

Vulnerabilities affecting azure-msal-node
ID	Severity	Summary	Affected versions	Published	Source
GHSA-xcx6-jx8p-x3h5	High	MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. ### Patches Version 7.1.0 and higher are patched. ### Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode	`>= 5.0.0-beta.0, < 7.1.0`	2026-10-23	GitHub (opens in a new tab)
GHSA-m5vv-6r4h-3vj9	Moderate	Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.	`>= 2.7.0, < 2.9.2`	2024-06-11	GitHub (opens in a new tab)

GHSA-xcx6-jx8p-x3h5High
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
- >= 5.0.0-beta.0, < 7.1.0
2026-10-23GitHub (opens in a new tab)
### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. ### Patches Version 7.1.0 and higher are patched. ### Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode
CVE: CVE-2026-109461
GHSA-m5vv-6r4h-3vj9Moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
- >= 2.7.0, < 2.9.2
2024-06-11GitHub (opens in a new tab)
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
CVE: CVE-2024-35255