GHSA-ppf9-4ffw-hh4p
NoneCVSS
—
EPSS
—
Published
Feb 19, 2026
CISA due date
—
The record
Feathers has an open redirect in OAuth callback enables account takeover
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @feathersjs/authentication-oauth | 0 | 5.0.40 |
Related vulnerabilities
- CVE-2026-27191 Feathersjs is a framework for creating web APIs and real-time applications with… Same vulnerability
- GHSA-wg9x-qfgw-pxhj Feathers has an OAuth Callback Account Takeover issue Also affects @feathersjs/authentication-oauth
- CVE-2026-29792 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27193 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27192 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- GHSA-9m9c-vpv5-9g85 Feathers exposes internal headers via unencrypted session cookie Also affects @feathersjs/authentication-oauth
- GHSA-mp4x-c34x-wv3x Feathers has an origin validation bypass via prefix matching Also affects @feathersjs/authentication-oauth
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601