CVE-2026-29792: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29792 is a critical OAuth Callback Account Takeover vulnerability in the Feathersjs framework (@feathersjs/authentication-oauth npm package). An unauthenticated attacker can bypass OAuth authentication entirely by sending a crafted GET request directly to /oauth/:provider/callback with a forged user profile in the query string, obtaining a valid JWT access token for any existing user without contacting the OAuth provider. It affects Feathersjs versions 5.0.0 through 5.0.41 (inclusive) and was disclosed on March 10, 2026, with a fix released in version 5.0.42. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feathersjs Advisory).

The root cause is improper authentication (CWE-287) in the OAuth callback handler. The OAuth service's authentication payload uses a fallback chain: when Grant (the OAuth middleware) has no session or state — because no legitimate OAuth authorize flow was initiated — it produces an empty response, causing the handler to fall back to params.query, the raw HTTP request query string. An attacker exploits this by directly calling /oauth/:provider/callback with a crafted query string containing a forged user profile (e.g., email or user ID of a target account), which then drives entity lookup and JWT minting without any validation against the actual OAuth provider. The attack requires no privileges, no user interaction, and is executable remotely with low complexity (GitHub Advisory, Feathersjs Advisory).

Successful exploitation allows an unauthenticated attacker to obtain a valid JWT access token for any existing user account, effectively achieving full account takeover without the victim's knowledge or interaction. This results in high confidentiality and integrity impact — the attacker can access all data and perform any action available to the impersonated user. Depending on the application's architecture, this could enable privilege escalation (e.g., impersonating admin accounts), unauthorized data exfiltration, and lateral movement within systems relying on Feathersjs for authentication (Feathersjs Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability was reported by researcher sofianeelhor. The EPSS score is approximately 0.028% (0.08% per GitHub Advisory), placing it in the 24th percentile for exploitation likelihood within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low EPSS, the attack is trivially executable — requiring only a crafted HTTP GET request with no authentication — making it a high-priority patching target.

1. Reconnaissance: Identify applications built on Feathersjs (npm package @feathersjs/authentication-oauth) versions 5.0.0–5.0.41 that expose OAuth callback endpoints. Look for /oauth/:provider/callback routes (e.g., /oauth/google/callback, /oauth/github/callback) accessible over the internet.
2. Identify target user: Determine the profile identifier (e.g., email address or user ID) of the target account to impersonate. This may be obtained through OSINT, application features (e.g., public profiles), or prior reconnaissance.
3. Craft malicious GET request: Construct a GET request directly to the OAuth callback endpoint without initiating a legitimate OAuth flow. Include a forged profile in the query string matching the target user's identity, for example:

   GET /oauth/google/callback?profile[email]=victim@example.com&profile[id]=12345 HTTP/1.1
   Host: target-app.example.com

4. Trigger fallback chain: Because no OAuth authorize flow was initiated, Grant has no session or state, producing an empty response. The authentication handler falls back to params.query (the raw query string), using the attacker-supplied forged profile for entity lookup.
5. Receive JWT token: The server performs a user lookup based on the forged profile data, finds the matching account, and mints a valid JWT access token, which is returned to the attacker in the response.
6. Account takeover: Use the obtained JWT to authenticate as the victim user against the application's API, gaining full access to their account and data (Feathersjs Advisory, GitHub Advisory).

• Network: Unexpected GET requests to /oauth/:provider/callback endpoints that contain profile-related parameters (e.g., profile[email], profile[id], profile[sub]) in the query string without a preceding OAuth authorize request from the same source IP.
• Network: OAuth callback requests originating from IPs with no prior session or authorization flow activity; requests lacking expected OAuth code or state parameters but containing profile data.
• Logs: Application/access logs showing GET /oauth/*/callback requests with query strings containing user profile fields (e.g., profile, email, id) from unexpected sources.
• Logs: JWT issuance events in authentication logs that are not preceded by a corresponding OAuth provider redirect or authorization code exchange.
• Application Behavior: User accounts showing login activity or session creation at unusual times or from unexpected geographic locations, particularly via OAuth providers, without corresponding OAuth provider-side login events.

The primary remediation is to upgrade @feathersjs/authentication-oauth to version 5.0.42 or later, which fixes the fallback chain vulnerability (Feathersjs Advisory). As an interim workaround prior to patching, restrict network-level access to /oauth/:provider/callback endpoints so they are only reachable following a valid OAuth provider redirect (e.g., via WAF rules requiring the presence of a valid state parameter and blocking requests with profile data in query strings). Additionally, implement strict input validation on all OAuth-related query parameters and monitor OAuth callback logs for anomalous patterns such as requests containing profile fields without a corresponding code or state parameter (GitHub Advisory).

The vulnerability was credited to researcher sofianeelhor and published by Feathersjs maintainer daffl on March 10, 2026 (Feathersjs Advisory). The disclosure received coverage across automated CVE tracking platforms and security feeds shortly after publication. No significant public researcher commentary, vendor statements beyond the advisory, or notable social media discussion has been identified beyond standard CVE aggregation activity.