GHSA-mp4x-c34x-wv3x

Source

https://github.com/advisories/GHSA-mp4x-c34x-wv3x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mp4x-c34x-wv3x/GHSA-mp4x-c34x-wv3x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mp4x-c34x-wv3x

Aliases

CVE-2026-27192

Published

2026-02-19T20:32:28Z

Modified

2026-02-23T23:43:54Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Feathers has an origin validation bypass via prefix matching

Details

The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.

The getAllowedOrigin() function checks if the Referer header starts with any allowed origin:

// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L75
const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase()));

This comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com).

On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover.

Credits: Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.

Database specific

{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-19T20:32:28Z",
    "nvd_published_at":  "2026-02-21T04:15:58Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / @feathersjs/authentication-oauth

Package

Name: @feathersjs/authentication-oauth; View open source insights on deps.dev
Purl: pkg:npm/%40feathersjs/authentication-oauth

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.0.40

Database specific

last_known_affected_version_range

"<= 5.0.39"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mp4x-c34x-wv3x/GHSA-mp4x-c34x-wv3x.json"