Feathers has an OAuth Callback Account Takeover issue

Description

An unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service’s authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant’s session/state responses are empty.

Recommendation

Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.0.0, <= 5.0.41
• Patched version(s): 5.0.42

References

• GHSA-wg9x-qfgw-pxhj
• CVE-2026-29792
• CWE-287
• CAPEC-310