Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
What type of information could be disclosed by this vulnerability? Exploiting this vulnerability could allow the disclosure of credentials. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation requires an affected application to use a specific sign-in handling pattern and rely on default authority discovery without predefined authority metadata. Applications that do not meet both conditions are not exposed to this attack.
Andrew Federico with <a href="https://www.azuritesolutions.com/">Azurite Solutions, LLC</a>