Newly disclosed CVE-2026-109461 warns of token leaks in MSAL Node loopback setups

What the advisory describes

On 23 October 2026, a security write-up appeared on dev.to under the DevOmniTools Security Suite byline, publicising an advisory recorded as CVE-2026-109461 and reportedly disclosed the same evening. According to the post, the advisory covers a scenario in which the authorization code flow in MSAL Node — Microsoft's authentication library for Node.js — can hand sensitive parameters to an endpoint controlled by an attacker. The authorization code flow is the standard OAuth sequence web applications use to exchange a code for access tokens.

The author frames the outcome as a critical credential leak in developer workflows: when applications expose internal loopback listeners or misconfigure cookie serialization attributes, authentication secrets and signing tokens can be harvested across local origin boundaries.

How the leak is said to work

The post identifies two contributing conditions. The first concerns loopback listeners. Development servers and local microservices often run on 127.0.0.1 or inside shared developer containers, and the author argues that when DNS rebinding protection is missing, any local web script or malicious iframe can query the loopback port — reaching data a developer might reasonably assume is sealed off on their own machine. Cookies marked HttpOnly and SameSite normally reinforce that assumption, the post notes, but browser-mediated local access can sidestep that intent.

The second condition is weak token validation. Tokens accepted without explicit audience (aud) and issuer (iss) checks, the post argues, open the door to cross-tenant impersonation, where a credential minted for one context is honoured in another.

Suggested mitigations

The write-up's hardening advice falls into three buckets:

• Revoke anything exposed. Rotate leaked secrets and revoke tokens in the identity provider's dashboard immediately, rather than waiting for expiry.
• Tighten listener configuration. Bind development HTTP listeners exclusively to 127.0.0.1 and add explicit Host header guards so rebinding attempts fail.
• Validate every claim. Enforce aud and iss checks before a token is trusted.

The post also warns developers against pasting production tokens into online formatters that transmit the payload to third-party servers, recommending instead that signatures be verified in local browser memory using the Web Crypto API. It promotes DevOmniTools' offline JWT inspector as a zero-upload option. One caveat for anyone copying the article's sample verifier: the published function imports an HMAC key but returns true without ever comparing the computed signature, so as written it would accept any token.

Caveats about the source

The story currently rests on a single dev.to post that doubles as product marketing — the research is credited to, and repeatedly steers readers toward, DevOmniTools' own tooling. The write-up lists no affected version ranges, no patch or vendor workaround, no CVSS score, and no link to a primary advisory from Microsoft or a CVE database, so the critical rating is the author's characterisation rather than a verified severity. The general technical argument — unprotected loopback listeners and unvalidated claims are dangerous — aligns with long-standing security guidance, but teams running MSAL Node should confirm the CVE's status through official channels before prioritising it.

Why it matters

If confirmed, the described mechanism turns an ordinary developer machine into part of an application's trust boundary. Any service on localhost that holds or exchanges tokens becomes reachable through browser-mediated tricks such as DNS rebinding, and stolen tokens lacking audience or issuer checks can potentially be replayed across tenants. Even setting the CVE aside, the habits the post advocates — revoking exposed credentials, validating aud and iss on every token, binding listeners narrowly, and never pasting live tokens into unknown web tools — are inexpensive changes that close genuinely common attack paths in Node development environments.