7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27192

CVE-2026-27192: Feathers has an origin validation bypass via prefix matching

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27192

CVE-2026-27192:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/authentication-oauth	npm	<= 5.0.39	5.0.40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability lies in the OAuthStrategy.getRedirect function, which performed an insecure origin validation using startsWith. This allowed an attacker to craft a malicious domain that shared a prefix with a legitimate one, thereby bypassing the security check. An attacker could then initiate the OAuth authentication flow from their own domain. While the token would still be redirected to the legitimate application's configured callback URL, this flaw, combined with other misconfigurations or vulnerabilities, could allow the attacker to exfiltrate the access token and gain control of the user's account. The patch addresses this by replacing the flawed startsWith check with a strict origin comparison using the URL API to parse the referer and compare its origin. Additionally, a related security hardening was applied in OAuthService.create to prevent the leakage of sensitive request headers into the session cookie, reducing the overall attack surface.

Vulnerable functions

OAuthStrategy.getRedirect

packages/authentication-oauth/src/strategy.ts

The `getRedirect` function in the `OAuthStrategy` class was responsible for validating the origin of an OAuth request. It used `startsWith()` to compare the `Referer` header against a list of allowed origins. This method of comparison is insecure because it allows an attacker to register a domain with a prefix matching an allowed origin (e.g., `https://allowed.com.attacker.com` would be allowed if `https://allowed.com` is in the list). This bypasses the origin check and can be used to initiate an OAuth flow from an untrusted domain, potentially leading to token theft and account takeover. The patch corrects this by parsing the `Referer` as a URL and performing an exact match on the origin.

OAuthService.create

packages/authentication-oauth/src/service.ts

The `create` method in the `OAuthService` class was storing all request headers into the session during the OAuth initiation. This could lead to the exposure of sensitive internal headers (e.g., API keys, internal IP addresses added by proxies) if they were present in the request. These headers would be stored in the session cookie, making them accessible. The patch mitigates this information disclosure risk by only storing the `referer` header, which is necessary for origin validation, instead of all headers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.