CVE-2026-27192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27192", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T19:47:02.154Z", "datePublished": "2026-02-21T03:50:35.954Z", "dateUpdated": "2026-02-23T19:13:45.407Z"}, "containers": {"cna": {"title": "Feathers has an origin validation bypass via prefix matching", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x"}, {"name": "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401", "tags": ["x_refsource_MISC"], "url": "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401"}, {"name": "https://github.com/feathersjs/feathers/releases/tag/v5.0.40", "tags": ["x_refsource_MISC"], "url": "https://github.com/feathersjs/feathers/releases/tag/v5.0.40"}], "affected": [{"vendor": "feathersjs", "product": "feathers", "versions": [{"version": "< 5.0.40", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T03:50:35.954Z"}, "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40."}], "source": {"advisory": "GHSA-mp4x-c34x-wv3x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:13:28.459847Z", "id": "CVE-2026-27192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:13:45.407Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-23T19:13:28.459847Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:13:39.864Z"}}], "cna": {"title": "Feathers has an origin validation bypass via prefix matching", "source": {"advisory": "GHSA-mp4x-c34x-wv3x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "feathersjs", "product": "feathers", "versions": [{"status": "affected", "version": "< 5.0.40"}]}], "references": [{"url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x", "name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401", "name": "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/feathersjs/feathers/releases/tag/v5.0.40", "name": "https://github.com/feathersjs/feathers/releases/tag/v5.0.40", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T03:50:35.954Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27192", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:13:45.407Z", "dateReserved": "2026-02-18T19:47:02.154Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T03:50:35.954Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "feathers", "vendor": "feathersjs", "versions": [{"status": "affected", "version": "< 5.0.40"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5396E6E0-0D34-409C-A8A6-57AF06A90FEE", "versionEndExcluding": "5.0.40", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40."}, {"lang": "es", "value": "Feathersjs es un framework para crear APIs web y aplicaciones en tiempo real con TypeScript o JavaScript. En las versiones 5.0.39 e inferiores, la validaci\u00f3n de origen utiliza startsWith() para la comparaci\u00f3n, lo que permite a los atacantes eludir la verificaci\u00f3n al registrar un dominio que comparte un prefijo com\u00fan con un origen permitido. La funci\u00f3n getAllowedOrigin() comprueba si el encabezado Referer comienza con cualquier origen permitido, y esta comparaci\u00f3n es insuficiente ya que solo valida el prefijo. Esto es explotable cuando el array de or\u00edgenes est\u00e1 configurado y un atacante registra un dominio que comienza con una cadena de origen permitida (p. ej., https://target.com.attacker.com elude https://target.com). Por s\u00ed solos, los tokens siguen siendo redirigidos a un origen configurado. Sin embargo, en escenarios espec\u00edficos un atacante puede iniciar el flujo de OAuth desde un origen no autorizado y exfiltrar tokens, logrando una toma de control total de la cuenta. Este problema ha sido solucionado en la versi\u00f3n 5.0.40."}], "id": "CVE-2026-27192", "lastModified": "2026-06-17T10:26:49.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:13:28.459847Z", "version": "2.0.3"}}]}, "published": "2026-02-21T04:15:58.697", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/feathersjs/feathers/releases/tag/v5.0.40"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "feathers", "source": "cna", "vendor": "feathersjs"}, "product": "feathers", "vendor": "feathersjs"}], "analysis": {"en": {"generated_at": "2026-04-17T16:56:50.421790+00:00", "value": {"mitigation_remediation": ["Upgrade Feathers to version 5.0.40 or later where the origin validation logic has been corrected.", "If upgrading is not immediately possible, restrict the list of allowed origins to exact, trusted domains and avoid using prefix matching, or implement a custom validator that checks the full origin string.", "Review and limit OAuth redirect URIs and origin headers in the application configuration to prevent misuse by unauthorized domains."], "summary": {"action": "Patch", "impact": "Origin validation bypass enabling OAuth token exfiltration and potential account takeover."}, "threat_synthesis": {"affected_systems": "The affected product is the Feathersframework (feathersjs:feathers) running on Node.js. All releases up to and including version 5.0.39 are vulnerable; the defect was fixed in release 5.0.40.", "description_and_impact": "Feathersjs versions 5.0.39 and earlier validate request origins by checking whether the Referer header starts with any allowed origin, using startsWith. This prefix-only comparison allows an attacker to register a domain that shares a common prefix with an authorized origin (for example, https://target.com.attacker.com matches https://target.com). The flaw can be exploited when the origins array is configured, enabling an unauthorized origin to initiate the OAuth flow and exfiltrate tokens. On a successful attack, the attacker can achieve full account takeover. The weakness corresponds to improper origin validation (CWE-346).", "risk_and_exploitability": "The vulnerability scores a 7.6 on the CVSS base list, indicating high severity, while the EPSS score is less than 1\u202f% suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Attackers would need to control or register a domain that shares a common prefix with an allowed origin, and the target application must be configured to use OAuth with a permissive origins list. Because the flaw directly impacts the integrity of OAuth token handling, organizations should regard the risk as significant even though the exploitation likelihood remains very low."}}}}, "created": "2026-02-23T14:32:52.472549+00:00", "updated": "2026-04-17T17:00:10.200647+00:00", "vendors": ["feathersjs", "feathersjs$PRODUCT$feathers"]}