# CVE-2026-27191: Feathers open redirect in OAuth callback enables account takeover

Source: https://junglewise.ai/threats/cve-2026-27191-feathers-open-redirect-in-oauth-callback-enables-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27191 · Severity: medium · CVSS 4 · Published 2026-02-19

Feathers is a popular Node.js web framework with integrated OAuth authentication support. A vulnerability in the OAuth callback handler allows attackers to manipulate redirect URLs through URL authority injection, stealing users' access tokens and fully taking over their accounts. An attacker can craft a malicious link that tricks users into clicking it, causing their browser to send the OAuth access token to the attacker's server instead of the legitimate application.

Technologies: [Feathers Authentication-Oauth](https://junglewise.ai/threats/technologies/authentication-oauth), [@feathersjs/authentication-oauth (npm)](https://junglewise.ai/threats/technologies/feathersjs-authentication-oauth). Vendors: [Feathers](https://junglewise.ai/threats/vendors/feathers), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27191 being exploited in the wild.

**How severe is CVE-2026-27191?** Medium severity, with a CVSS score of 4, published 19 February 2026.

**Which products and versions are affected?** Feathers Authentication-Oauth <= 5.0.39; @feathersjs/authentication-oauth (npm) SEMVER:introduced=0,fixed=5.0.40.

**Is there a fix for CVE-2026-27191?** Yes. @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27191 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27191?** Check whether you run Feathers Authentication-Oauth or @feathersjs/authentication-oauth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later

  ```sh
  npm install @feathersjs/authentication-oauth@5.0.40
  ```


## Technical details

The vulnerability is an open redirect (CWE-601) in the OAuth authentication module that stems from insufficient validation of the redirect query parameter. When constructing the final OAuth callback redirect URL, the application concatenates a user-supplied redirect parameter directly with the configured origin without proper validation: `redirectUrl = ${redirect}${queryRedirect}`. An attacker can supply a specially crafted redirect value (e.g., `@attacker.com`) that, when concatenated with an origin lacking a trailing slash (e.g., `https://target.com`), results in `https://target.com@attacker.com#access_token=...`. RFC 3986 URL parsing rules cause the browser to interpret `attacker.com` as the host authority, redirecting the OAuth access token to the attacker's domain. No authentication is required; the attack requires user interaction (clicking a malicious link) and is exploitable only when the origins array is configured without trailing slashes. The fix is available in version 5.0.40 and later.

## Affected products

- Feathers authentication-oauth <= 5.0.39

## Identifiers

- CVE-2026-27191
- GHSA-ppf9-4ffw-hh4p

## Timeline

- 2026-02-18: disclosed
- 2026-02-19: patched: Fix released in version 5.0.40

## References

- [https://github.com/feathersjs/feathers/security/advisories/GHSA-ppf9-4ffw-hh4p](https://github.com/feathersjs/feathers/security/advisories/GHSA-ppf9-4ffw-hh4p)

## Related threats

- [Feathers OAuth callback account takeover](https://junglewise.ai/threats/cve-2026-29792-feathers-oauth-callback-account-takeover)
- [Feathers authentication-oauth information disclosure via unencrypted session cookie](https://junglewise.ai/threats/cve-2026-27193-feathers-authentication-oauth-information-disclosure-via)
- [Feathers authentication-oauth origin validation bypass via prefix matching](https://junglewise.ai/threats/cve-2026-27192-feathers-authentication-oauth-origin-validation-bypass-via-prefix)