Read the docs
TI-2026-21628 Aliases CVE-2026-27191GHSA-ppf9-4ffw-hh4p

Feathers: Open Redirect in OAuth callback enables account takeover

Priority LOW 34CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them. The application constructs the final redirect URL by concatenating the base origin with the user-supplied redirect parameter. This is exploitable when the origins array is configured and origin values do not end with /. An attacker can supply @attacker.com as the redirect value results in https://[email protected]#access_token=..., where the browser interprets attacker.com as the host, leading to full account takeover. This issue has been fixed in version 5.0.40.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed feathers (feathersjs): 5.0.40@feathersjs/authentication-oauth (npm): 5.0.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
feathersjsfeathersbefore 5.0.405.0.40Patch availableCNA
—@feathersjs/authentication-oauth (npm)before 5.0.405.0.40Patch availableGHSA-ppf9-4ffw-hh4p
  • feathers Vendorfeathersjs Affected before 5.0.40 Fixed in 5.0.40 Patch available CNA
  • @feathersjs/authentication-oauth (npm) Vendor— Affected before 5.0.40 Fixed in 5.0.40 Patch available GHSA-ppf9-4ffw-hh4p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:*before 5.0.40Vulnerablefeathersjs
  • cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:* Versions before 5.0.40 Vulnerable ·feathersjs

Remediation

  • Fix · CNA feathers (feathersjs) Fixed in 5.0.40
  • Fix · GHSA-ppf9-4ffw-hh4p @feathersjs/authentication-oauth (npm) Fixed in 5.0.40 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27191
  2. 2026-10-03 Alias added: GHSA-ppf9-4ffw-hh4p

References

Patch 1

Advisory 2

Other 2

  • TI-2023-19332 feathersjs socket handler allows abusing implicit toString CVSS 3.1HIGH 7.5
  • TI-2026-23379 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVSS 4.0CRITICAL 9.3
  • TI-2026-23378 Feathersjs has an OAuth Callback Account Takeover CVSS 4.0CRITICAL 9.3
  • TI-2026-21630 Feathers exposes internal headers via unencrypted session cookie CVSS 4.0HIGH 8.2
  • TI-2026-21629 Feathers has an origin validation bypass via prefix matching CVSS 4.0HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences