Description
The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.
Recommendation
Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.39
- Patched version(s): 5.0.40
References
Could your website be exposed too?
SmartScanner can check your website for Feathers has an origin validation bypass via prefix matching and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026