Is CVE-2026-27193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27193 being exploited in the wild.

How severe is CVE-2026-27193?

Medium severity, with a CVSS score of 4, published 19 February 2026.

Which products and versions are affected?

@feathersjs/authentication-oauth (npm) SEMVER:introduced=0,fixed=5.0.40.

Is there a fix for CVE-2026-27193?

Yes. @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27193 attacked?

It is attacked over the network.

Am I affected by CVE-2026-27193?

Check whether you run @feathersjs/authentication-oauth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27193: Feathers authentication-oauth information disclosure via unencrypted session cookie

CVE-2026-27193 · Severity: medium · CVSS 4 · Published 2026-02-19

Feathers is a JavaScript framework for building real-time APIs and web applications. The OAuth authentication module stores all HTTP request headers—including internal infrastructure details like API keys and service tokens—in session cookies that are signed but not encrypted. An attacker can decode the base64-encoded cookie to read these sensitive internal headers, potentially exposing infrastructure secrets and internal IP addresses in deployments behind proxies or API gateways.

Technologies: @feathersjs/authentication-oauth (npm). Vendors: npm.

Quick answers

Is CVE-2026-27193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27193 being exploited in the wild.
How severe is CVE-2026-27193?: Medium severity, with a CVSS score of 4, published 19 February 2026.
Which products and versions are affected?: @feathersjs/authentication-oauth (npm) SEMVER:introduced=0,fixed=5.0.40.
Is there a fix for CVE-2026-27193?: Yes. @feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27193 attacked?: It is attacked over the network.
Am I affected by CVE-2026-27193?: Check whether you run @feathersjs/authentication-oauth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@feathersjs/authentication-oauth (npm): upgrade to 5.0.40 or later
```
npm install @feathersjs/authentication-oauth@5.0.40
```

Technical details

The vulnerability is an information disclosure (CWE-200) in the Feathers @feathersjs/authentication-oauth package. The OAuth service stores the complete HTTP headers object in the session cookie via `session.headers = headers`, and these cookies are persisted using cookie-session which base64-encodes but does not encrypt the data. While the cookie is HMAC-signed to prevent tampering, the contents remain readable to anyone who decodes the base64 value. The attack requires network access to intercept or view session cookies; no authentication or user interaction is needed. In deployments behind reverse proxies or API gateways that inject internal headers (e.g., X-Forwarded-For, X-Real-IP, or internal authorization tokens), this exposes sensitive infrastructure details. The vulnerability is fixed in version 5.0.40 and later.

Affected products

Feathers @feathersjs/authentication-oauth <= 5.0.39

Identifiers

CVE-2026-27193
GHSA-9m9c-vpv5-9g85

Timeline

2026-02-19: disclosed: Advisory published on GitHub and OSV
2026-02-19: patched: Fixed in version 5.0.40

References

https://github.com/feathersjs/feathers/security/advisories/GHSA-9m9c-vpv5-9g85

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.