Description
The redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim’s access token and can impersonate them.
Recommendation
Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.39
- Patched version(s): 5.0.40
References
Could your website be exposed too?
SmartScanner can check your website for Feathers has an open redirect in OAuth callback enables account takeover and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Feathers has an OAuth Callback Account Takeover issue - CVE-2026-29792
- Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026