Feathers exposes internal headers via unencrypted session cookie

Description

All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.

Recommendation

Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.0.39
• Patched version(s): 5.0.40

References

• GHSA-9m9c-vpv5-9g85
• CVE-2026-27193
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
• Feathers has an OAuth Callback Account Takeover issue - CVE-2026-29792
• Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter - CVE-2026-29793
• Feathers has an open redirect in OAuth callback enables account takeover - CVE-2026-27191

Tags:

npm

@feathersjs/authentication-oauth