Description
The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.
Recommendation
Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.39
- Patched version(s): 5.0.40
References
Could your website be exposed too?
SmartScanner can check your website for Feathers has an origin validation bypass via prefix matching and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
- Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter - CVE-2026-29793
- LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body - CVE-2026-44645
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026