Executive brief
Feathers is a popular Node.js web framework with integrated OAuth authentication support. A vulnerability in the OAuth callback handler allows attackers to manipulate redirect URLs through URL authority injection, stealing users' access tokens and fully taking over their accounts. An attacker can craft a malicious link that tricks users into clicking it, causing their browser to send the OAuth access token to the attacker's server instead of the legitimate application.
Technical details
The vulnerability is an open redirect (CWE-601) in the OAuth authentication module that stems from insufficient validation of the redirect query parameter. When constructing the final OAuth callback redirect URL, the application concatenates a user-supplied redirect parameter directly with the configured origin without proper validation: `redirectUrl = ${redirect}${queryRedirect}`. An attacker can supply a specially crafted redirect value (e.g., `@attacker.com`) that, when concatenated with an origin lacking a trailing slash (e.g., `https://target.com`), results in `https://target.com@attacker.com#access_token=...`. RFC 3986 URL parsing rules cause the browser to interpret `attacker.com` as the host authority, redirecting the OAuth access token to the attacker's domain. No authentication is required; the attack requires user interaction (clicking a malicious link) and is exploitable only when the origins array is configured without trailing slashes. The fix is available in version 5.0.40 and later.
Affected products
- Feathers authentication-oauth <= 5.0.39
Timeline
- 2026-02-18: disclosed
- 2026-02-19: patched: Fix released in version 5.0.40