AIKIDO-2026-10042

TL;DR

Affected versions of this package are vulnerable to Information Exposure via Logs due to the MsalServiceException.ToString() method, including sensitive HTTP response headers (such as authentication tokens or API keys) in its string representation. This flaw could allow an attacker with access to application logs, error messages, or debug outputs to retrieve these exposed credentials. By scraping logs or triggering errors, an attacker could capture tokens and use them to impersonate users or gain unauthorized access to protected resources and APIs. The fix removes headers from the ToString() output while keeping the Headers property accessible programmatically to prevent accidental exposure without introducing breaking changes.