CVE-2026-27191: Feathers open redirect in OAuth callback enables account takeover

CVE-2026-27191 · Severity: medium · CVSS 4 · Published 2026-02-19

Feathers is a popular Node.js web framework with integrated OAuth authentication support. A vulnerability in the OAuth callback handler allows attackers to manipulate redirect URLs through URL authority injection, stealing users' access tokens and fully taking over their accounts. An attacker can craft a malicious link that tricks users into clicking it, causing their browser to send the OAuth access token to the attacker's server instead of the legitimate application.

Technologies: Feathers Authentication-Oauth, @feathersjs/authentication-oauth (npm). Vendors: Feathers, npm.

Quick answers

Is CVE-2026-27191 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27191 being exploited in the wild.
How severe is CVE-2026-27191?
Medium severity, with a CVSS score of 4, published 19 February 2026.
Which products and versions are affected?
Feathers Authentication-Oauth <= 5.0.39; @feathersjs/authentication-oauth (npm) SEMVER:introduced=0,fixed=5.0.40.
Is there a fix for CVE-2026-27191?
Yes. @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27191 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27191?
Check whether you run Feathers Authentication-Oauth or @feathersjs/authentication-oauth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later
    npm install @feathersjs/authentication-oauth@5.0.40

Technical details

The vulnerability is an open redirect (CWE-601) in the OAuth authentication module that stems from insufficient validation of the redirect query parameter. When constructing the final OAuth callback redirect URL, the application concatenates a user-supplied redirect parameter directly with the configured origin without proper validation: `redirectUrl = ${redirect}${queryRedirect}`. An attacker can supply a specially crafted redirect value (e.g., `@attacker.com`) that, when concatenated with an origin lacking a trailing slash (e.g., `https://target.com`), results in `https://target.com@attacker.com#access_token=...`. RFC 3986 URL parsing rules cause the browser to interpret `attacker.com` as the host authority, redirecting the OAuth access token to the attacker's domain. No authentication is required; the attack requires user interaction (clicking a malicious link) and is exploitable only when the origins array is configured without trailing slashes. The fix is available in version 5.0.40 and later.

Affected products

  • Feathers authentication-oauth <= 5.0.39

Identifiers

  • CVE-2026-27191
  • GHSA-ppf9-4ffw-hh4p

Timeline

  • 2026-02-18: disclosed
  • 2026-02-19: patched: Fix released in version 5.0.40

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.