CVE-2026-27192
📋 TL;DR
FeathersJS versions 5.0.39 and below have an origin validation vulnerability where the getAllowedOrigin() function uses startsWith() for comparison, allowing attackers to bypass CORS/CSRF protections by registering domains with common prefixes. This affects applications using FeathersJS with configured allowed origins, potentially enabling attackers to exfiltrate OAuth tokens and achieve account takeover.
💻 Affected Systems
- FeathersJS
📦 What is this software?
Feathers by Feathersjs
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover via OAuth token exfiltration when attacker initiates OAuth flow from malicious domain that bypasses origin validation
Likely Case
CSRF attacks and unauthorized API access from attacker-controlled domains that share prefixes with allowed origins
If Mitigated
Limited impact if proper token validation and additional security layers are implemented
🎯 Exploit Status
Exploitation requires attacker to register domain with prefix matching allowed origin and initiate OAuth flow
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.40
Vendor Advisory: https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x
Restart Required: Yes
Instructions:
1. Update FeathersJS to version 5.0.40 or higher
2. Run: npm update @feathersjs/feathers
3. Restart your application
4. Verify the fix by checking package.json version
🔧 Temporary Workarounds
Strict Origin Validation
allImplement custom origin validation that performs exact string matching instead of prefix matching
Implement custom middleware to validate origins with exact string comparison
🧯 If You Can't Patch
- Implement additional CSRF protection layers and strict token validation
- Monitor and restrict domains that could be registered with prefixes matching your allowed origins
🔍 How to Verify
Check if Vulnerable:
Check package.json for @feathersjs/feathers version <=5.0.39 and verify if origins array is configuredCheck Version:
npm list @feathersjs/feathersVerify Fix Applied:
Verify package.json shows @feathersjs/feathers version >=5.0.40 and test origin validation with malicious prefix domains📡 Detection & Monitoring
Log Indicators:
- Requests from domains with suspicious prefixes matching allowed origins
- Failed origin validation attempts
Network Indicators:
- OAuth flows initiated from unexpected domains
- Referer headers with unusual domain structures
SIEM Query:
source="feathersjs" AND (referer CONTAINS ".attacker." OR origin_validation="failed")