9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29792

CVE-2026-29792: Feathersjs has an OAuth Callback Account Takeover

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29792

CVE-2026-29792:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/authentication-oauth	npm	>= 5.0.0, <= 5.0.41	5.0.42

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @feathersjs/authentication-oauth package, specifically within the get method of the OAuthService class. The core of the issue is an improper trust in user-provided data from the URL query string during the OAuth callback process. The application code had a fallback mechanism that, in the absence of a valid OAuth session response, would use the raw query parameters of the request as the authentication payload. This allowed an unauthenticated attacker to bypass the entire OAuth flow and directly call the callback endpoint with a forged user profile in the query parameters. The application would then mistakenly trust this forged data, leading to the creation of a valid session token for the user specified in the forged profile, resulting in a full account takeover. The patch addresses this by removing the unsafe fallback to params.query and adding a strict check to ensure a valid OAuth response is present. Any attempt to call the callback endpoint without a valid session now results in an authentication error.

Vulnerable functions

OAuthService.get

packages/authentication-oauth/src/service.ts

The `get` method in the `OAuthService` class was vulnerable because it used the request's query parameters (`params.query`) as a fallback for the authentication payload. An attacker could send a crafted GET request to the `/oauth/:provider/callback` endpoint with a forged user profile in the query string. Since the attacker did not initiate a proper OAuth flow, the primary payload sources would be empty, causing the application to use the attacker-controlled query parameters to generate an authentication payload. This allowed the attacker to impersonate any user and gain access to their account.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.