GHSA-wg9x-qfgw-pxhj
NoneCVSS
—
EPSS
—
Published
Mar 10, 2026
CISA due date
—
The record
Feathers has an OAuth Callback Account Takeover issue
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @feathersjs/authentication-oauth | 5.0.0 | 5.0.42 |
Related vulnerabilities
- CVE-2026-29792 Feathersjs is a framework for creating web APIs and real-time applications with… Same vulnerability
- CVE-2026-27193 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27191 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- CVE-2026-27192 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
- GHSA-9m9c-vpv5-9g85 Feathers exposes internal headers via unencrypted session cookie Also affects @feathersjs/authentication-oauth
- GHSA-mp4x-c34x-wv3x Feathers has an origin validation bypass via prefix matching Also affects @feathersjs/authentication-oauth
- GHSA-ppf9-4ffw-hh4p Feathers has an open redirect in OAuth callback enables account takeover Also affects @feathersjs/authentication-oauth
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287