CVE-2026-27192: @feathersjs/authentication-oauth Origin Validation Bypass Vulnerability
Summary
CVE-2026-27192: Feathers has an origin validation bypass via prefix matching. Affects @feathersjs/authentication-oauth versions < 5.0.40. Fixed in 5.0.40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @feathersjs/authentication-oauth package is a part of the Feathers framework, which provides a set of tools for building real-time applications and REST APIs using JavaScript. This package specifically handles OAuth authentication, allowing developers to integrate various OAuth providers into their applications. However, it has a vulnerability that can lead to unauthorized access due to improper origin validation.
Vulnerability Detail
The vulnerability arises from the use of the startsWith() method for origin validation in the getAllowedOrigin() function. This method allows attackers to bypass the origin check by registering a domain that shares a common prefix with an allowed origin. For instance, if https://target.com is an allowed origin, an attacker could register https://target.com.attacker.com, which would pass the validation check. This flaw can lead to scenarios where an attacker initiates the OAuth flow from an unauthorized origin, potentially exfiltrating tokens and achieving full account takeover.
How To Fix
Minimum fixed version
5.0.40
This is the first release that contains the fix.
npm install @feathersjs/authentication-oauth@5.0.40Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the origins by implementing a stricter comparison method that checks for exact matches rather than prefix matches. For example, you can modify the origin validation logic as follows:
const allowedOrigin = origins.find((current) => referer.toLowerCase() === current.toLowerCase());
Conclusion
The CVE-2026-27192 vulnerability in the @feathersjs/authentication-oauth package poses a significant risk due to improper origin validation. It is crucial for developers using this package to update to the patched version 5.0.40 to mitigate potential security risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for @feathersjs/authentication-oauth →
FAQ
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to user accounts, allowing attackers to exfiltrate tokens and potentially take over accounts.
Yes, a patch is available in version 5.0.40 of the @feathersjs/authentication-oauth package. It is recommended to update to this version.
If you cannot update the package immediately, consider implementing a stricter origin validation logic as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @feathersjs/authentication-oauth.
