CVE-2026-84003

CVE-2026-84003 is an authentication bypass by capture-replay (CWE-294) in the Microsoft Authentication Library (MSAL) for Node.js, the library Node.js applications use to authenticate users and services against Microsoft's identity platform. An attacker positioned on the network who can capture authentication material in transit can replay it to authenticate as a legitimate user or client, with no privileges or user interaction required; the high attack complexity reflects the difficulty of intercepting and replaying the exchange while it remains valid. Successful exploitation enables spoofing with high impact on confidentiality and integrity (the attacker can act as the victim), though there is no availability impact. Any organization running Node.js server applications, APIs, daemons, or CLIs that depend on MSAL for Node.js is affected, with end users of those applications exposed through them. As of this writing there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.4% (37th percentile); the fix shipped in Microsoft's September 2026 Patch Tuesday.

What to do: Upgrade the @azure/msal-node package to the patched release issued with September 2026 Patch Tuesday (check Microsoft's advisory for the exact fixed version numbers) and redeploy every Node.js service that depends on it. Review Microsoft Entra ID sign-in and authentication logs for the same captured credentials or tokens being replayed from unexpected sources, and prioritize internet-facing or network-exposed services where traffic interception is feasible. Note the high attack complexity: exploitation requires an attacker to capture in-flight authentication material, so exposure depends heavily on network paths and TLS posture.