GHSA-9m9c-vpv5-9g85
NoneCVSS
—
EPSS
—
Published
Feb 19, 2026
CISA due date
—
The record
Feathers exposes internal headers via unencrypted session cookie
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @feathersjs/authentication-oauth | 0 | 5.0.40 |
Related vulnerabilities
- CVE-2026-27193 Feathersjs is a framework for creating web APIs and real-time applications with… Same vulnerability
- GHSA-wg9x-qfgw-pxhj Feathers has an OAuth Callback Account Takeover issue Also affects @feathersjs/authentication-oauth
- CVE-2026-29792 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27191 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27192 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- GHSA-mp4x-c34x-wv3x Feathers has an origin validation bypass via prefix matching Also affects @feathersjs/authentication-oauth
- GHSA-ppf9-4ffw-hh4p Feathers has an open redirect in OAuth callback enables account takeover Also affects @feathersjs/authentication-oauth
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200