CVE-2026-27192: Feathers authentication-oauth origin validation bypass via prefix matching

CVE-2026-27192 · Severity: medium · CVSS 4 · Published 2026-02-19

Feathers is a JavaScript framework for building real-time APIs and web applications. The authentication OAuth module validates request origins using a flawed prefix matching algorithm, allowing attackers to bypass origin checks by registering attacker-controlled domains that share a prefix with legitimate origins. An attacker can exploit this to initiate OAuth flows from unauthorized domains, intercept authentication tokens, and achieve complete account takeover of users relying on OAuth authentication.

Technologies: Feathers Authentication-Oauth, @feathersjs/authentication-oauth (npm). Vendors: Feathers, npm.

Quick answers

Is CVE-2026-27192 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27192 being exploited in the wild.
How severe is CVE-2026-27192?
Medium severity, with a CVSS score of 4, published 19 February 2026.
Which products and versions are affected?
Feathers Authentication-Oauth <= 5.0.39; @feathersjs/authentication-oauth (npm) SEMVER:introduced=0,fixed=5.0.40.
Is there a fix for CVE-2026-27192?
Yes. @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27192 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27192?
Check whether you run Feathers Authentication-Oauth or @feathersjs/authentication-oauth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later
    npm install @feathersjs/authentication-oauth@5.0.40

Technical details

The vulnerability exists in the getAllowedOrigin() function within the authentication-oauth package, which uses startsWith() to validate the Referer header against a whitelist of allowed origins. This prefix-based comparison is insufficient because it does not enforce a boundary between the allowed origin and the attacker's domain (e.g., https://target.com.attacker.com matches an allowed origin of https://target.com). An attacker can register a domain starting with a legitimate origin string, allowing them to pass the validation check. The attack requires the OAuth configuration to have an origins array defined, and relies on the attacker's ability to register a domain with the required prefix. Once validation is bypassed, the attacker can initiate an OAuth flow from their unauthorized origin, exfiltrate authentication tokens, and assume full control of victim accounts. The fix is available in version 5.0.40, which should employ proper boundary validation instead of simple prefix matching.

Affected products

  • Feathers authentication-oauth <= 5.0.39

Identifiers

  • CVE-2026-27192
  • GHSA-mp4x-c34x-wv3x

Timeline

  • 2026-02-19: disclosed
  • 2026-02-19: patched: Version 5.0.40 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.