CVE-2026-27192: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27192 is an origin validation bypass vulnerability in the @feathersjs/authentication-oauth package (part of the FeathersJS framework) that allows attackers to circumvent origin checks during OAuth flows by registering a domain sharing a common prefix with an allowed origin. It affects all versions of @feathersjs/authentication-oauth up to and including 5.0.39 for Node.js. The vulnerability was published on February 18, 2026, and assigned a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory). It was discovered and reported by Abdelwahed Madani Yousfi, Edoardo Geraci, and Thomas Rinsma from Codean Labs (Feathers Security Advisory).

The root cause is an Origin Validation Error (CWE-346) in the getAllowedOrigin() function within packages/authentication-oauth/src/strategy.ts. The function uses JavaScript's startsWith() for case-insensitive prefix matching of the HTTP Referer header against the configured origins array: const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase())). This means a domain like https://target.com.attacker.com would pass validation for an allowed origin of https://target.com, because the referer string starts with the allowed origin prefix (GitHub Advisory). Exploitation requires the origins array to be configured on the target application and, in specific scenarios, allows an attacker to initiate the OAuth flow from an unauthorized origin and intercept or redirect OAuth tokens. The fix replaces prefix matching with exact origin comparison using new URL(referer).origin parsed against each allowed origin (Patch Commit).

Successful exploitation in applicable scenarios enables an attacker to exfiltrate OAuth access tokens issued during the authentication flow, leading to full account takeover of affected users. Confidentiality and integrity of user accounts are both severely impacted, as stolen tokens grant the attacker the same privileges as the legitimate user. Availability is not directly impacted by this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.018% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to register a domain with a prefix matching an allowed origin and to engineer a scenario where a victim initiates an OAuth flow from the attacker-controlled domain.

1. Reconnaissance: Identify a target application built on FeathersJS (@feathersjs/authentication-oauth <= 5.0.39) that has the origins array configured in its OAuth settings, and determine the allowed origins (e.g., https://target.com).
2. Register attacker domain: Register a domain that shares a prefix with the allowed origin, such as https://target.com.attacker.com or https://target.com-evil.attacker.com.
3. Host malicious page: Set up a web page on the attacker-controlled domain that initiates the OAuth authentication flow against the vulnerable Feathers application, sending a Referer header of https://target.com.attacker.com/login.
4. Bypass origin validation: The vulnerable getAllowedOrigin() function evaluates 'https://target.com.attacker.com/login'.startsWith('https://target.com') as true, incorrectly treating the attacker's domain as an allowed origin.
5. Lure victim: Trick a victim user into visiting the attacker's page (e.g., via phishing), causing them to initiate the OAuth flow from the unauthorized origin.
6. Exfiltrate token: In specific application configurations, the OAuth token is redirected or accessible to the attacker's origin, allowing the attacker to capture it and use it to take over the victim's account (GitHub Advisory, Patch Commit).

• Network: OAuth callback or redirect requests originating from unexpected or suspicious domains that share a prefix with configured allowed origins (e.g., https://target.com.attacker.com).
• Logs: Application logs showing Referer headers from domains not in the configured origins allowlist that nonetheless passed origin validation (in unpatched versions); unexpected OAuth token issuance events for sessions initiated from unfamiliar origins.
• Authentication Events: Multiple OAuth token grants for the same user account from different or unusual origins within a short time window; account logins from IP addresses or locations inconsistent with the user's normal behavior following an OAuth flow.

Upgrade @feathersjs/authentication-oauth to version 5.0.40 or later, which replaces the insecure startsWith() prefix check with exact origin comparison using new URL(referer).origin (Feathers Release v5.0.40, Patch Commit). As a configuration-level mitigation, review and tighten the origins array to include only the minimum necessary origins. Monitor OAuth authentication flows for tokens being redirected to unexpected locations. No official workaround short of upgrading has been published.

The vulnerability was credited to researchers Abdelwahed Madani Yousfi (@vvxhid), Edoardo Geraci (@b0-n0-b0), and Thomas Rinsma (@ThomasRinsma) from Codean Labs, who responsibly disclosed it to the FeathersJS maintainers (Feathers Security Advisory). The fix was promptly released by maintainer daffl in version 5.0.40. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.