7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27191

CVE-2026-27191: Feathers: Open Redirect in OAuth callback enables account takeover

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them. The application constructs the final redirect URL by concatenating the base origin with the user-supplied redirect parameter. This is exploitable when the origins array is configured and origin values do not end with /. An attacker can supply @attacker.com as the redirect value results in https://target.com@attacker.com#access_token=..., where the browser interprets attacker.com as the host, leading to full account takeover. This issue has been fixed in version 5.0.40.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27191

CVE-2026-27191:

7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/authentication-oauth	npm	<= 5.0.39	5.0.40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect within the Feathers.js OAuth authentication mechanism, enabling account takeover. The root cause is the improper construction of a redirect URL using unvalidated user input. By analyzing the patch commit ee19a0ae9bc2ebf23b1fe598a1f7361981b65401, two key functions were identified.

The primary vulnerable function is OAuthStrategy.getRedirect in packages/authentication-oauth/src/strategy.ts. This function concatenated a user-supplied redirect parameter with a base URL without proper sanitization. The patch introduced a regular expression check to reject characters (@, //, \\) that can be used to manipulate the URL's authority, thereby fixing the open redirect.

A secondary function, OAuthService.create in packages/authentication-oauth/src/service.ts, is the entry point that first receives the malicious redirect parameter from the user and stores it in the session for later processing. An exploit would involve an attacker crafting a URL with a malicious redirect value (e.g., ?redirect=@attacker.com). When a victim follows this link, OAuthService.create processes the request, and OAuthStrategy.getRedirect later constructs a URL like https://legitimate.com@attacker.com#access_token=.... The browser sends the access token to the attacker's domain, leading to account takeover.

Vulnerable functions

OAuthStrategy.getRedirect

packages/authentication-oauth/src/strategy.ts

This function constructs the final redirect URL by concatenating a configured base URL with the user-provided 'redirect' query parameter (`queryRedirect`). The vulnerability lies in the lack of validation for the `queryRedirect` parameter before this concatenation. An attacker could provide a value like '@attacker.com', which, when appended to the base URL (e.g., 'https://legitimate.com'), creates a URL ('https://legitimate.com@attacker.com') that the browser interprets as having 'attacker.com' as the host. This allows the attacker to steal the access token included in the URL fragment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.