A flaw in Microsoft Authentication Library (MSAL) for Node.js permits an unauthenticated attacker to obtain sensitive data remotely due to an origin validation error—identified by CWE-346. The weakness allows a malicious party to see details that it should not access, potentially exposing configuration or token information.

Microsoft Identity Client for NodeJS is vulnerable. No specific version range is listed in the available data, so all installations of the library that contain the unpatched code are at risk.

The CVSS score of 5.9 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. The likely attack vector is a network-based request with a malformed or missing Origin header; because the origin check is ineffective, the attacker can retrieve disallowed information. No additional conditions are mentioned, so the patch is purely client-side.