Executive brief
Feathers is a JavaScript framework for building real-time APIs and web applications. The authentication OAuth module validates request origins using a flawed prefix matching algorithm, allowing attackers to bypass origin checks by registering attacker-controlled domains that share a prefix with legitimate origins. An attacker can exploit this to initiate OAuth flows from unauthorized domains, intercept authentication tokens, and achieve complete account takeover of users relying on OAuth authentication.
Technical details
The vulnerability exists in the getAllowedOrigin() function within the authentication-oauth package, which uses startsWith() to validate the Referer header against a whitelist of allowed origins. This prefix-based comparison is insufficient because it does not enforce a boundary between the allowed origin and the attacker's domain (e.g., https://target.com.attacker.com matches an allowed origin of https://target.com). An attacker can register a domain starting with a legitimate origin string, allowing them to pass the validation check. The attack requires the OAuth configuration to have an origins array defined, and relies on the attacker's ability to register a domain with the required prefix. Once validation is bypassed, the attacker can initiate an OAuth flow from their unauthorized origin, exfiltrate authentication tokens, and assume full control of victim accounts. The fix is available in version 5.0.40, which should employ proper boundary validation instead of simple prefix matching.
Affected products
- Feathers authentication-oauth <= 5.0.39
Timeline
- 2026-02-19: disclosed
- 2026-02-19: patched: Version 5.0.40 released