CVE-2026-84003: CWE-294: Authentication Bypass by Capture-replay in Microsoft Microsoft Authentication Library

This vulnerability, identified as CWE-294 (Authentication Bypass by Capture-replay), exists in Microsoft Authentication Library (MSAL) for Node.js. An attacker can exploit this flaw by capturing authentication tokens or data and replaying them to bypass authentication controls, effectively spoofing legitimate users. The affected versions are >=1.0.0 and <5.6.0. Microsoft has published an official fix to address this issue.

Successful exploitation allows an attacker with network access to bypass authentication mechanisms in MSAL for Node.js, potentially gaining unauthorized access to protected resources or services. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft Authentication Library for Node.js should update to version 5.6.0 or later to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84003 for detailed patching instructions.