Feathersjs has an OAuth Callback Account Takeover
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| feathersjs | feathers | 5.0.0 to before 5.0.42 | 5.0.42 | Patch available | CNA |
| feathersjs | authentication-oauth | 5.0.0 to before 5.0.42 | 5.0.42 | Patch available | CNA |
| — | @feathersjs/authentication-oauth (npm) | 5.0.0 to before 5.0.42 | 5.0.42 | Patch available | GHSA-wg9x-qfgw-pxhj |
- feathers Vendorfeathersjs Affected 5.0.0 to before 5.0.42 Fixed in 5.0.42 Patch available CNA
- authentication-oauth Vendorfeathersjs Affected 5.0.0 to before 5.0.42 Fixed in 5.0.42 Patch available CNA
- @feathersjs/authentication-oauth (npm) Vendor— Affected 5.0.0 to before 5.0.42 Fixed in 5.0.42 Patch available GHSA-wg9x-qfgw-pxhj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:* | 5.0.0 to before 5.0.42 | Vulnerable | feathersjs |
- cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:* Versions 5.0.0 to before 5.0.42 Vulnerable ·feathersjs
Remediation
- Fix · CNA feathers (feathersjs) Fixed in 5.0.42
- Fix · CNA authentication-oauth (@feathersjs) Fixed in 5.0.42
- Fix · GHSA-wg9x-qfgw-pxhj @feathersjs/authentication-oauth (npm) Fixed in 5.0.42 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29792
- 2026-10-03 Alias added: GHSA-wg9x-qfgw-pxhj
- 2026-10-14 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More feathersjs Feathers vulnerabilities
- TI-2023-19332 feathersjs socket handler allows abusing implicit toString CVSS 3.1HIGH 7.5
- TI-2026-23379 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVSS 4.0CRITICAL 9.3
- TI-2026-21630 Feathers exposes internal headers via unencrypted session cookie CVSS 4.0HIGH 8.2
- TI-2026-21629 Feathers has an origin validation bypass via prefix matching CVSS 4.0HIGH 7.6
- TI-2026-21628 Feathers: Open Redirect in OAuth callback enables account takeover CVSS 4.0HIGH 7.4
Sources
- CVE-2026-29792 · CVE Program
- CVE-2026-29792 · NVD
- FIRST EPSS
- GHSA-wg9x-qfgw-pxhj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences