Feathers exposes internal headers via unencrypted session cookie

Description

All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.

Recommendation

Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.0.39
• Patched version(s): 5.0.40

References

• GHSA-9m9c-vpv5-9g85
• CVE-2026-27193
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
• Parse Server exposes auth data via /users/me endpoint - CVE-2026-33627
• Parse Server has a session field immutability bypass via falsy-value guard - CVE-2026-34574
• Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter - CVE-2026-30965

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@feathersjs/authentication-oauth