CVE-2026-27193: @feathersjs/authentication-oauth Exposes Internal Headers via Unencrypted Session Cookie
Summary
CVE-2026-27193: Feathers exposes internal headers via unencrypted session cookie. Affects @feathersjs/authentication-oauth versions < 5.0.40. Fixed in 5.0.40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @feathersjs/authentication-oauth package is a part of the Feathers framework, which is designed for building real-time applications and REST APIs using JavaScript or TypeScript. This package specifically facilitates OAuth authentication, allowing developers to integrate third-party authentication services seamlessly. However, it has been identified that the package stores all HTTP request headers in a session cookie that is signed but not encrypted, leading to potential exposure of sensitive internal information.
Vulnerability Detail
The vulnerability arises from the way the @feathersjs/authentication-oauth package handles session cookies. All HTTP request headers are stored in the session cookie, which is base64-encoded but not encrypted. This means that while the cookie is signed to prevent tampering, its contents can be easily decoded by anyone with access to the cookie. In specific deployment scenarios, such as when the application is behind reverse proxies or API gateways, this can lead to the exposure of sensitive internal infrastructure details, including API keys, service tokens, and internal IP addresses. The severity of this vulnerability is rated high, with a CVSS score of 8.2.
How To Fix
Minimum fixed version
5.0.40
This is the first release that contains the fix.
npm install @feathersjs/authentication-oauth@5.0.40Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider not storing sensitive headers in the session cookie. You can modify the code where the headers are assigned to the session to exclude sensitive information. For example, instead of storing all headers, you can selectively store only the necessary ones.
Conclusion
The vulnerability CVE-2026-27193 in the @feathersjs/authentication-oauth package exposes internal headers through an unencrypted session cookie, posing significant security risks. It is crucial to update to the patched version 5.0.40 to mitigate these risks. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @feathersjs/authentication-oauth →
FAQ
The session cookie stores all HTTP request headers in a signed but unencrypted format, making it vulnerable to exposure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The risks include exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses, which could lead to unauthorized access or data breaches.
Yes, a patch is available in version 5.0.40 of the @feathersjs/authentication-oauth package. It is recommended to update to this version.
If an immediate update is not possible, consider implementing a workaround by modifying the code to avoid storing sensitive headers in the session cookie.
References
Related vulnerabilities
Recent vulnerabilities recorded for @feathersjs/authentication-oauth.
