CVE-2026-29792: @feathersjs/authentication-oauth OAuth Callback Account Takeover Vulnerability
Summary
CVE-2026-29792: Feathers has an OAuth Callback Account Takeover issue. Affects @feathersjs/authentication-oauth versions >= 5.0.0, < 5.0.42. Fixed in 5.0.42. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @feathersjs/authentication-oauth package is a part of the Feathers framework, which provides a flexible and powerful way to build real-time applications. This package specifically handles OAuth authentication, allowing developers to integrate various OAuth providers into their applications seamlessly. However, it is crucial to ensure that the implementation is secure, as vulnerabilities in authentication mechanisms can lead to severe security breaches.
Vulnerability Detail
The vulnerability arises from an OAuth Callback Account Takeover issue where an unauthenticated attacker can exploit the callback endpoint. By sending a crafted GET request to '/oauth/:provider/callback' with a forged profile in the query string, the attacker can bypass the OAuth authorization flow. The fallback mechanism in the authentication payload allows the attacker to obtain a valid access token for an existing user without ever contacting the OAuth provider. This critical vulnerability (CVSS score 9.8) can lead to unauthorized access and potential data breaches.
How To Fix
Minimum fixed version
5.0.42
This is the first release that contains the fix.
npm install @feathersjs/authentication-oauth@5.0.42Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not expose the '/oauth/:provider/callback' endpoint without proper authentication checks. Implement additional validation on the incoming requests to prevent unauthorized access until the package can be updated.
Conclusion
In summary, CVE-2026-29792 is a critical vulnerability in the @feathersjs/authentication-oauth package that can lead to account takeover through the OAuth callback mechanism. It is essential to update to the patched version 5.0.42 or later to mitigate this risk. Additionally, implementing temporary workarounds can help secure your application until the update is applied.
See every vulnerability recorded for @feathersjs/authentication-oauth →
FAQ
CVE-2026-29792 is a critical vulnerability in the @feathersjs/authentication-oauth package that allows an attacker to perform an account takeover via the OAuth callback endpoint.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If you cannot update the package right away, implement additional security measures to validate incoming requests to the OAuth callback endpoint to prevent unauthorized access.
The consequences include unauthorized access to user accounts, data breaches, and potential exploitation of sensitive information within your application.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just your package-lock.json file, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for @feathersjs/authentication-oauth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
