97 matches found
CVE-2026-27193
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth servi...
CVE-2026-27191
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
CVE-2026-27193
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth servi...
CVE-2026-27192
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
CVE-2026-27191
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
@alinex/server (>=0.3.0, <=1.3.7), @conneryn/c6o-cli (>=0.0.2, <=0.0.6) +40 more potentially affected by CVE-2026-27193 via @feathersjs/authentication-oauth (>=4.3.0, <=5.0.12)
@feathersjs/authentication-oauth NPM version =4.3.0, =0.3.0, =0.0.2, =0.1.15, =0.0.74, =0.2.0, =1.1.2, =1.3.36, =0.0.1-alpha.0, =0.6.5 - @mocapi/authentication-module 1.0.0 - @mocapi/content-module 1.0.0 - @mocapi/document-module 1.0.0 - @mocapi/relation-module 1.0.0 and more Source cves:...
CVE-2026-27193 Feathers exposes internal headers via unencrypted session cookie
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth servi...
CVE-2026-27193
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth servi...
CVE-2026-27193
Feathersjs versions ≤ 5.0.39 store all HTTP request headers in the signed but unencrypted session cookie. The complete headers object (including internal proxy/gateway headers, API keys, tokens, and internal IPs) is base64-encoded in the cookie and readable by clients, exposing sensitive infrastr...
CVE-2026-27192
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
CVE-2026-27192
Feathersjs vulnerability CVE-2026-27192 affects 5.0.39 and earlier. The origin validation in getAllowedOrigin() uses startsWith() to compare Referer against allowed origins, which can be bypassed by registering a domain with a shared prefix (e.g., https://target.com.attacker.com vs https://target...
CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
@alinex/server (>=0.3.0, <=1.3.7), @conneryn/c6o-cli (>=0.0.2, <=0.0.6) +40 more potentially affected by CVE-2026-27192 via @feathersjs/authentication-oauth (>=4.3.0, <=5.0.12)
@feathersjs/authentication-oauth NPM version =4.3.0, =0.3.0, =0.0.2, =0.1.15, =0.0.74, =0.2.0, =1.1.2, =1.3.36, =0.0.1-alpha.0, =0.6.5 - @mocapi/authentication-module 1.0.0 - @mocapi/content-module 1.0.0 - @mocapi/document-module 1.0.0 - @mocapi/relation-module 1.0.0 and more Source cves:...
CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
CVE-2026-27191 Feathers: Open Redirect in OAuth callback enables account takeover
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
CVE-2026-27191 Feathers: Open Redirect in OAuth callback enables account takeover
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
@alinex/server (>=0.3.0, <=1.3.7), @conneryn/c6o-cli (>=0.0.2, <=0.0.6) +40 more potentially affected by CVE-2026-27191 via @feathersjs/authentication-oauth (>=4.3.0, <=5.0.12)
@feathersjs/authentication-oauth NPM version =4.3.0, =0.3.0, =0.0.2, =0.1.15, =0.0.74, =0.2.0, =1.1.2, =1.3.36, =0.0.1-alpha.0, =0.6.5 - @mocapi/authentication-module 1.0.0 - @mocapi/content-module 1.0.0 - @mocapi/document-module 1.0.0 - @mocapi/relation-module 1.0.0 and more Source cves:...
CVE-2026-27191
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
CVE-2026-27191
Feathersjs (Feathers) Open Redirect in OAuth callback (CVE-2026-27191) affects versions 5.0.39 and earlier where the redirect query parameter is appended to the base origin without validation. This allows an attacker to steal victims’ access tokens via URL authority injection, leading to account ...