CVE-2026-27191: Open Redirect Vulnerability in @feathersjs/authentication-oauth Leading to Account Takeover
Summary
CVE-2026-27191: Feathers has an open redirect in OAuth callback enables account takeover. Affects @feathersjs/authentication-oauth versions < 5.0.40. Fixed in 5.0.40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @feathersjs/authentication-oauth package is a widely used library in the Feathers framework that facilitates OAuth authentication for applications. It allows developers to easily integrate third-party authentication providers into their applications, enabling users to log in using their existing accounts from services like Google, Facebook, and others. However, this package has a critical vulnerability that allows attackers to manipulate redirect URLs, potentially leading to account takeover.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'redirect' query parameter, which is concatenated with the base origin without adequate validation. This flaw allows attackers to inject malicious URLs, leading to scenarios where the victim's access token can be stolen. When the 'origins' array is configured without proper termination (i.e., not ending with a '/'), an attacker can craft a redirect URL that tricks the browser into interpreting a malicious domain as the legitimate host. This results in full account takeover, as the attacker can impersonate the victim using their access token.
How To Fix
Minimum fixed version
5.0.40
This is the first release that contains the fix.
npm install @feathersjs/authentication-oauth@5.0.40Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the 'origins' array is configured correctly, with all values ending with a '/'. This can help mitigate the risk of URL authority injection until the package is updated. For example, configure your origins like this: ['https://target.com/'] instead of ['https://target.com'].
Conclusion
The CVE-2026-27191 vulnerability in the @feathersjs/authentication-oauth package poses a significant risk of account takeover due to improper handling of redirect URLs. It is crucial for developers using this package to update to the patched version or implement the recommended workaround to safeguard their applications.
See every vulnerability recorded for @feathersjs/authentication-oauth →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to account takeover, allowing attackers to impersonate users and gain unauthorized access to sensitive information.
Yes, a patch is available in version 5.0.40 of the @feathersjs/authentication-oauth package. It is recommended to update to this version to mitigate the risk.
If immediate updates are not possible, implement the suggested workaround by ensuring that the 'origins' array values end with a '/' to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @feathersjs/authentication-oauth.
