PT-2026-21347 · Unknown · Feathersjs

Abdelwahed Madani Yousfi + 5 · Publicado 2026-02-19 · Atualizado 2026-02-21 · CVE-2026-27192

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Feathersjs versions 5.0.39 and below

Description Feathersjs is a framework used for building web APIs and real-time applications. A flaw in origin validation, specifically using the startsWith() function for comparison, allows attackers to bypass origin checks. This bypass is possible by registering a domain that shares a common prefix with an allowed origin. The getAllowedOrigin() function inadequately validates the prefix of the Referer header against allowed origins. An attacker can initiate the OAuth flow from an unauthorized origin and potentially steal tokens, leading to full account takeover.

Recommendations Update to version 5.0.40 or later.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2026-27192

GHSA-MP4X-C34X-WV3X

Produtos afetados

Feathersjs

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27192.json · Exploit
• https://github.com/feathersjs/feathers · Nota
• https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401 · Correção
• https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x · Nota
• https://github.com/feathersjs/feathers/releases/tag/v5.0.40 · Nota
• https://osv.dev/vulnerability/CVE-2026-27192 · Aviso do Fabricante
• https://t.me/CVEtracker/45342 · Publicação no Telegram
• https://t.me/cveNotify/152692 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025154198149472739 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mp4x-c34x-wv3x · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27192 · Nota de Segurança
• https://twitter.com/offseq/status/2025065479123902483 · Publicação no Twitter