CVE-2026-84003: MSAL Node.js Auth Bypass Vulnerability

CVE-2026-84003 Overview

CVE-2026-84003 is an authentication bypass by capture-replay vulnerability affecting the Microsoft Authentication Library (MSAL) for Node.js. An unauthenticated network attacker can capture valid authentication material and replay it to spoof a legitimate identity. Successful exploitation compromises confidentiality and integrity of authenticated sessions without requiring user interaction. The weakness is classified under [CWE-294: Authentication Bypass by Capture-replay].

Critical Impact
Attackers who observe or intercept authentication traffic can replay captured credentials or tokens to impersonate legitimate users against applications built on MSAL for Node.js.

Affected Products

Microsoft Authentication Library (MSAL) for Node.js
Node.js applications integrating MSAL for Microsoft identity authentication
Downstream services relying on MSAL-issued authentication flows

Discovery Timeline

2026-09-08 - CVE-2026-84003 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84003

Vulnerability Analysis

The vulnerability resides in the authentication flow handling of MSAL for Node.js. The library fails to sufficiently bind authentication material to a unique session context, allowing previously observed authentication requests or responses to be replayed by an attacker. When the library processes a replayed message, it treats the captured artifact as a fresh, valid authentication event.

Because the attack path is network-based and requires no privileges or user interaction, an adversary positioned to observe authentication traffic can achieve spoofing without breaking cryptography. The advisory notes elevated attack complexity, indicating specific timing or positioning conditions must be met. Impact spans both confidentiality and integrity of authenticated sessions but does not affect availability.

Root Cause

The root cause is insufficient replay protection on authentication artifacts processed by MSAL for Node.js. Weak nonce validation, missing timestamp enforcement, or absent single-use guarantees on tokens or authentication messages enable captured material to be accepted on subsequent submissions. This aligns with the [CWE-294] pattern where an authentication protocol lacks freshness guarantees.

Attack Vector

Exploitation requires an attacker to first capture legitimate authentication traffic between a client using MSAL for Node.js and the Microsoft identity endpoint. The captured message is then replayed against the target application or service. If replay validation is absent or bypassable, the library accepts the replayed artifact and authenticates the attacker as the original user. Refer to the Microsoft Security Update CVE-2026-84003 advisory for technical specifics.

Detection Methods for CVE-2026-84003

Indicators of Compromise

Duplicate authentication requests carrying identical nonces, authorization codes, or token identifiers within short time windows
Successful authentication events originating from IP addresses or geolocations inconsistent with the legitimate user's baseline
MSAL log entries showing token acceptance after prior use of the same code or assertion
Concurrent active sessions for a single identity from disparate network origins

Detection Strategies

Correlate MSAL client logs with Entra ID sign-in logs to identify authorization codes or assertions reused across sessions
Deploy anomaly detection on authentication event streams to flag repeated use of identifiers that should be single-use
Alert on authentication successes immediately followed by session activity from a different network path

Monitoring Recommendations

Ingest MSAL for Node.js authentication logs and Microsoft Entra ID sign-in telemetry into a centralized SIEM for correlation
Baseline normal authentication patterns per user and application, then alert on deviations in source, timing, or artifact reuse
Monitor for TLS interception indicators and network conditions that could permit an attacker to capture authentication traffic

How to Mitigate CVE-2026-84003

Immediate Actions Required

Upgrade MSAL for Node.js to the fixed version listed in the Microsoft Security Response Center advisory
Inventory all Node.js applications and services that depend on MSAL, directly or transitively
Rotate any long-lived tokens, client secrets, or refresh tokens associated with affected applications
Review authentication and sign-in logs for signs of replay activity dating back to before the patch

Patch Information

Microsoft has published guidance and fixed versions in the Microsoft Security Update CVE-2026-84003 advisory. Update the @azure/msal-node dependency to the patched release in all affected projects and rebuild deployment artifacts.

Workarounds

Enforce TLS 1.2 or higher on all endpoints handling authentication traffic to limit an attacker's ability to capture messages
Shorten token and authorization code lifetimes to reduce the replay window
Enable Conditional Access policies in Microsoft Entra ID that require device compliance or trusted network location for sensitive applications
Require multi-factor authentication and continuous access evaluation where supported

bash

# Update MSAL for Node.js to the patched release
npm install @azure/msal-node@latest
npm audit