CVE-2026-27192
Feathers has an origin validation bypass via prefix matching
Impact
The origin validation uses `startsWith()` for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin. The `getAllowedOrigin()` function checks if the Referer header starts with any allowed origin: ```javascript // https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L75 const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase())); ``` This comparison is insufficient as it only validates the prefix. This is exploitable when the `origins` array is configured and an attacker registers a domain starting with an allowed origin string (e.g., `https://target.com.attacker.com` bypasses `https://target.com`). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. **Credits**: Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @feathersjs/authentication-oauth | <= 5.0.39 | 5.0.40 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Feathersjs | Feathers | before 5.0.40 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401
- https://github.com/feathersjs/feathers/releases/tag/v5.0.40
- https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x
- https://github.com/advisories/GHSA-mp4x-c34x-wv3x
- https://nvd.nist.gov/vuln/detail/CVE-2026-27192