Skip to content
OpenAdvisories
High MSRC-CVE-2026-108469 1 CVE

Microsoft Authentication Library for JavaScript Spoofing Vulnerability

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires an application to have enabled the optional popup relay feature and deployed its relay page without a Content Security Policy that blocks the attack. The attacker cannot configure these settings on the victim application.

Security updates
5.21.0 — https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/CHANGELOG.md#5210

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-108469

    Microsoft Authentication Library for JavaScript Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Authentication Library for JavaScript

Revision history

  1. #1

    Information published.

References