CVE-2026-27193: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27193 is an information disclosure vulnerability in the Feathers framework's @feathersjs/authentication-oauth package, where all HTTP request headers are stored in an unencrypted (base64-encoded), signed session cookie, exposing sensitive internal infrastructure details to clients. It affects all versions of @feathersjs/authentication-oauth up to and including 5.0.39 for Node.js. The vulnerability was disclosed on February 18, 2026, published to the GitHub Advisory Database on February 19, 2026, and to NVD on February 21, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feathers Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In packages/authentication-oauth/src/service.ts, the OAuth service assigns the entire HTTP headers object to the session: session.headers = headers;. The session is persisted via cookie-session, which base64-encodes the session data and signs it to prevent tampering — but does not encrypt it. Any client can decode the base64 cookie value to read all stored headers in plaintext. The vulnerability is particularly impactful in deployments behind reverse proxies or API gateways, where headers such as X-Forwarded-For, X-Internal-API-Key, Authorization, and internal IP addresses may be injected by infrastructure components and subsequently exposed to end users (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated or unauthenticated client initiating an OAuth flow to decode the session cookie and read all HTTP request headers stored within it. In environments using reverse proxies or API gateways, this can expose API keys, service tokens, internal IP addresses, and other sensitive infrastructure metadata that should never be visible to clients. While there is no direct integrity or availability impact, the exposed credentials and infrastructure details could enable follow-on attacks against internal services, lateral movement within the network, or targeted exploitation of backend systems (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires the attacker to be able to initiate an OAuth flow and receive the resulting session cookie, which is a low barrier in most deployments (GitHub Advisory).

1. Identify a vulnerable target: Locate a web application using @feathersjs/authentication-oauth version ≤ 5.0.39 that is deployed behind a reverse proxy or API gateway (e.g., nginx, AWS API Gateway) which injects sensitive headers.
2. Initiate an OAuth flow: Send an HTTP GET request to the application's OAuth initiation endpoint (e.g., /oauth/github). The reverse proxy will automatically inject internal headers such as X-Forwarded-For, X-Internal-API-Key, or Authorization into the request.
3. Capture the session cookie: Observe the Set-Cookie response header. The feathers.oauth cookie will be set with a base64-encoded, signed session payload.
4. Decode the cookie: Extract the cookie value, URL-decode it, and base64-decode it: Buffer.from(cookieValue, 'base64').toString('utf-8'). Parse the resulting JSON to access the headers object containing all stored HTTP request headers.
5. Extract sensitive data: Read values such as API keys (x-internal-api-key), internal IPs (x-real-ip, x-forwarded-for), or other infrastructure secrets from the decoded session data for use in further attacks (GitHub Advisory, Patch Commit).

• Network: Unusual or repeated GET requests to OAuth initiation endpoints (e.g., /oauth/github, /oauth/<provider>) from clients not completing the full OAuth flow, potentially indicating cookie harvesting attempts.
• Logs: Application logs showing OAuth session initiation without subsequent callback completion; access logs with requests to OAuth endpoints from unexpected IP ranges or user agents.
• File System: No direct file system artifacts expected for passive information disclosure exploitation.
• Application Behavior: Evidence of internal API keys or service tokens being used from external or unexpected IP addresses, suggesting harvested credentials are being leveraged for follow-on access.

Upgrade @feathersjs/authentication-oauth to version 5.0.40 or later, which restricts session header storage to only the referer header required for origin validation, instead of storing the entire headers object (Feathers Release, Patch Commit). As an interim workaround, review and restrict which headers your reverse proxy or API gateway injects into requests forwarded to the Feathers application, removing any sensitive headers before they reach the application layer. Additionally, consider auditing existing session cookies for exposed sensitive data and rotating any potentially compromised API keys or service tokens.

The vulnerability was discovered and responsibly disclosed by Abdelwahed Madani Yousfi (@vvxhid), Edoardo Geraci (@b0-n0-b0), and Thomas Rinsma (@ThomasRinsma) from Codean Labs. The Feathers maintainer (daffl) published the advisory and patch promptly on February 18, 2026. No significant broader media coverage or notable community debate has been observed beyond the standard advisory and patch release (GitHub Advisory, Feathers Advisory).