CVE-2026-29792

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29792", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T16:26:02.900Z", "datePublished": "2026-03-10T20:06:34.801Z", "dateUpdated": "2026-03-11T14:10:22.938Z"}, "containers": {"cna": {"title": "Feathersjs has an OAuth Callback Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj"}], "affected": [{"vendor": "feathersjs", "product": "feathers", "versions": [{"version": ">= 5.0.0, < 5.0.42", "status": "affected"}]}, {"vendor": "@feathersjs", "product": "authentication-oauth", "versions": [{"version": ">= 5.0.0, < 5.0.42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:09:29.800Z"}, "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42."}], "source": {"advisory": "GHSA-wg9x-qfgw-pxhj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:10:12.430093Z", "id": "CVE-2026-29792", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:10:22.938Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Feathersjs has an OAuth Callback Account Takeover", "source": {"advisory": "GHSA-wg9x-qfgw-pxhj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "feathersjs", "product": "feathers", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}, {"vendor": "@feathersjs", "product": "authentication-oauth", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}], "references": [{"url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj", "name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:09:29.800Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29792", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T14:10:12.430093Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:10:17.344Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-29792", "state": "PUBLISHED", "dateUpdated": "2026-03-10T20:09:29.800Z", "dateReserved": "2026-03-04T16:26:02.900Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T20:06:34.801Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "feathers", "vendor": "feathersjs", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}, {"product": "authentication-oauth", "vendor": "@feathersjs", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "485A252B-0C51-4136-A310-520BBD332346", "versionEndExcluding": "5.0.42", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42."}, {"lang": "es", "value": "Feathersjs es un framework para crear APIs web y aplicaciones en tiempo real con TypeScript o JavaScript. Desde la 5.0.0 hasta antes de la 5.0.42, un atacante no autenticado puede enviar una solicitud GET manipulada directamente a /oauth/:provider/callback con un perfil falsificado en la cadena de consulta. La carga \u00fatil de autenticaci\u00f3n del servicio OAuth tiene una cadena de reserva que alcanza params.query (la consulta de solicitud sin procesar) cuando las respuestas de sesi\u00f3n/estado de Grant est\u00e1n vac\u00edas. Dado que el atacante nunca inici\u00f3 un flujo de autorizaci\u00f3n OAuth, Grant no tiene sesi\u00f3n con la que trabajar y no produce ninguna respuesta, por lo que la reserva se activa. El perfil falsificado luego impulsa la b\u00fasqueda de entidades y la acu\u00f1aci\u00f3n de JWT. El atacante obtiene un token de acceso v\u00e1lido para un usuario existente sin contactar nunca al proveedor OAuth. Esta vulnerabilidad se corrige en la 5.0.42."}], "id": "CVE-2026-29792", "lastModified": "2026-06-17T10:29:53.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29792", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:10:12.430093Z", "version": "2.0.3"}}]}, "published": "2026-03-10T20:16:39.283", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "authentication-oauth", "source": "cna", "vendor": "@feathersjs"}, "product": "authentication-oauth", "vendor": "feathersjs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "feathers", "source": "cna", "vendor": "feathersjs"}, "product": "feathers", "vendor": "feathersjs"}], "analysis": {"en": {"generated_at": "2026-04-16T09:30:53.365242+00:00", "value": {"mitigation_remediation": ["Upgrade Feathersjs to version 5.0.42 or later to apply the vendor-provided fix.", "If an upgrade is not feasible, modify the application to validate that an OAuth session or state is present before processing /oauth/:provider/callback requests, rejecting any callback without a corresponding initiate flow.", "Monitor application logs for anomalous /oauth/:provider/callback activity and restrict access to the callback endpoint if possible."], "summary": {"action": "Immediate Patch", "impact": "Access token forgery leading to account takeover"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Feathersjs authentication-oauth and feathers framework versions from 5.0.0 up to but not including 5.0.42. Users of these packages running a web API or real-time application that exposes the /oauth/:provider/callback route are potentially impacted.", "description_and_impact": "An unauthenticated attacker can craft a GET request to the /oauth/:provider/callback endpoint with a forged profile in the query string. Because the OAuth service uses a fallback chain that reaches the raw request query when the session information is absent, the forged profile can drive entity lookup and cause the framework to issue a valid JSON Web Token. This results in an attacker obtaining a legitimate access token for an existing user without ever contacting the OAuth provider. The weakness is an Authentication Bypass, described by CWE-287.", "risk_and_exploitability": "The CVSS score of 9.3 indicates a critical severity, while the EPSS score of under 1% reflects a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a remote HTTP request, requiring no prior authentication or interaction with the OAuth provider, and can be triggered simply by visiting the crafted callback URL."}}}}, "created": "2026-03-11T11:43:04.388237+00:00", "updated": "2026-04-16T09:45:31.663586+00:00", "vendors": ["feathersjs", "feathersjs$PRODUCT$authentication-oauth", "feathersjs$PRODUCT$feathers"]}