8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27193

CVE-2026-27193: Feathers exposes internal headers via unencrypted session cookie

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, then the session is persisted using cookie-session, which base64-encodes the data. While the cookie is signed to prevent tampering, the contents are readable by anyone by simply decoding the base64 value. Under specific deployment configurations (e.g., behind reverse proxies or API gateways), this can lead to exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses. This issue has been fixed in version 5.0.40.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27193

CVE-2026-27193:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/authentication-oauth	npm	<= 5.0.39	5.0.40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an information disclosure issue where sensitive HTTP headers are stored in an unencrypted session cookie. The provided patch directly addresses this. By analyzing the commit ee19a0ae9bc2ebf23b1fe598a1f7361981b65401, I identified the exact location of the vulnerability.

The file packages/authentication-oauth/src/service.ts contains the OAuthService class. Within this class, the create method was responsible for handling the initial phase of an OAuth flow. The line session.headers = headers is the root cause of the vulnerability, as it copies all request headers into the session. The patch replaces this line to selectively store only the referer header, which is required for origin validation, thus preventing the leakage of other potentially sensitive headers.

Therefore, the function OAuthService.create is the vulnerable function that would appear in a runtime profile when the vulnerability is triggered. The exploitation occurs when a user initiates an OAuth authentication flow, and the application is deployed behind a proxy that adds internal headers to the request.

Vulnerable functions

OAuthService.create

packages/authentication-oauth/src/service.ts

The `create` method of the `OAuthService` class was storing the entire `headers` object from the incoming request into the session. This session is then stored in a client-side cookie. Since the cookie is only signed and not encrypted, the contents, including potentially sensitive internal headers added by reverse proxies or gateways (e.g., API keys, internal IP addresses), could be read by the client by simply Base64-decoding the cookie value. The patch mitigates this by only storing the `referer` header, which is necessary for other parts of the authentication flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.