CVE-2026-29792 Feathersjs has an OAuth Callback Account Takeover
An unauthenticated attacker can forge OAuth callback requests to bypass authentication and obtain valid access tokens for existing users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29792?
CVE-2026-29792 is a critical authentication bypass vulnerability in @feathersjs authentication-oauth, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42.
Weakness: CWE-287
Which versions are affected by CVE-2026-29792?
2 open source packages ship an affected version, including @feathersjs/authentication-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@feathersjs/authentication-oauth npm | From 5.0.0 | 5.0.42 |
@feathersjs/authentication-oauth npm | From 5.0.0 | 5.0.42 |
Products include Feathersjs Feathers.
How do I fix CVE-2026-29792?
Upgrade @feathersjs/authentication-oauth to 5.0.42 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-29792 being exploited?
There is no known exploitation of CVE-2026-29792 in the wild and no public exploit code.
Other vulnerabilities in @feathersjs authentication-oauth
- CVE-2026-29793 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
- CVE-2026-27193 Feathers exposes internal headers via unencrypted session cookie
- CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
- CVE-2023-37899 feathersjs socket handler allows abusing implicit toString
- CVE-2026-27191 Feathers: Open Redirect in OAuth callback enables account takeover
Sources
Also known as GHSA-wg9x-qfgw-pxhj.