Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-29792Feathersjs has an OAuth Callback Account Takeover
Critical 9.3
In plain English
A critical-severity improper authentication in authentication-oauth from @feathersjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @feathersjs/authentication-oauth | 5.0.42 | GHSA-wg9x-qfgw-pxhj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| feathersjs | feathers | >= 5.0.0, < 5.0.42 |
| @feathersjs | authentication-oauth | >= 5.0.0, < 5.0.42 |
Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj x_refsource_CONFIRM