Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-29792.md

Created March 10, 2026 23:10
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/dc81c1a2b7f709c06e63d38f24ae7eeb to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/dc81c1a2b7f709c06e63d38f24ae7eeb to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-29792: CVE-2026-29792: Unauthenticated Account Takeover via Improper Authentication in FeathersJS OAuth - CVE Security Report
Raw
CVE-2026-29792.md

CVE-2026-29792: CVE-2026-29792: Unauthenticated Account Takeover via Improper Authentication in FeathersJS OAuth

CVSS Score: 9.8 Published: 2026-03-10 Full Report: https://cvereports.com/reports/CVE-2026-29792

Summary

FeathersJS versions prior to 5.0.42 contain a critical improper authentication vulnerability in the OAuth callback handler. An unauthenticated attacker can forge user profile data via URL query parameters, bypassing the standard OAuth flow to obtain a valid JSON Web Token (JWT) for any user account.

TL;DR

A fallback logic flaw in the FeathersJS OAuth module allows attackers to supply arbitrary identity data in query parameters during the callback phase. This results in complete, unauthenticated account takeover.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network (Remote)
  • Authentication Required: None
  • CVSS v4.0: 9.3
  • Exploit Status: PoC Available
  • CISA KEV: No

Affected Systems

  • feathersjs framework
  • @feathersjs/authentication-oauth
  • @feathersjs/mongodb
  • @feathersjs/authentication-oauth: >= 5.0.0, < 5.0.42 (Fixed in: 5.0.42)
  • @feathersjs/mongodb: >= 5.0.0, < 5.0.42 (Fixed in: 5.0.42)

Mitigation

  • Upgrade @feathersjs/authentication-oauth and @feathersjs/mongodb to version 5.0.42 or higher.
  • Implement a pre-authentication hook to sanitize or reject requests containing profile objects in the URL query string.
  • Monitor access logs for direct hits to /oauth/*/callback containing suspicious query parameters.

Remediation Steps:

  1. Navigate to the project directory containing package.json.
  2. Execute npm install @feathersjs/authentication-oauth@^5.0.42 @feathersjs/mongodb@^5.0.42 or the equivalent command for yarn/pnpm.
  3. Verify the installed versions by checking npm list @feathersjs/authentication-oauth.
  4. Run the application's test suite to ensure no breaking changes affect authentication workflows.
  5. Deploy the updated application build to staging and production environments.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment