Microsoft MSAL.js: Cross-site scripting leading to spoofing
Summary
Microsoft Authentication Library for JavaScript (MSAL.js) contains a cross-site scripting (XSS) flaw in which input is not neutralized during web page generation. An unauthorized remote attacker may be able to perform spoofing over the network. Exploitation is rated high complexity and requires user interaction, and no public proof of concept or exploitation in the wild is known.
Affected
- Microsoft Authentication Library for JavaScript (MSAL.js) 1.0.0 to before 5.21.0
- Relevant only for custom or third-party web applications that embed MSAL.js
Fixed in
- Version 5.21.0 (implied by the CNA record; not yet confirmed against the vendor release notes or KB article)
Workaround
- Unknown. No vendor-published interim mitigation found.
- Apply the vendor update once available.
Exploitation
- Rapid7 rates exploitation as less likely and public disclosure as no.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or exploitation in the wild known.
Our recommendation
- Inventory web applications and dependencies that use MSAL.js (e.g. npm dependency scans).
- Update MSAL.js to 5.21.0 or later once the vendor package is confirmed.
- Ensure applications use a Content Security Policy and output encoding against XSS.
- Monitor vendor advisories for updates.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-108469 msrc.microsoft.com
- CVE.org record CVE-2026-108469 www.cve.org
- Rapid7 Patch Tuesday analysis November 2026 www.rapid7.com
- Microsoft Learn: MSAL.js overview learn.microsoft.com
- MSAL.js GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:42.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.