PT-2026-21347 · Unknown · Feathersjs

Abdelwahed Madani Yousfi + 5 · Published 2026-02-19 · Updated 2026-02-21 · CVE-2026-27192

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Feathersjs versions 5.0.39 and below

Description Feathersjs is a framework used for building web APIs and real-time applications. A flaw in origin validation, specifically using the startsWith() function for comparison, allows attackers to bypass origin checks. This bypass is possible by registering a domain that shares a common prefix with an allowed origin. The getAllowedOrigin() function inadequately validates the prefix of the Referer header against allowed origins. An attacker can initiate the OAuth flow from an unauthorized origin and potentially steal tokens, leading to full account takeover.

Recommendations Update to version 5.0.40 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-27192

GHSA-MP4X-C34X-WV3X

Affected Products

Feathersjs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27192.json · Exploit
• https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401 · Patch
• https://osv.dev/vulnerability/CVE-2026-27192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp4x-c34x-wv3x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27192 · Security Note
• https://github.com/feathersjs/feathers · Note
• https://github.com/feathersjs/feathers/security/advisories/GHSA-mp4x-c34x-wv3x · Note
• https://github.com/feathersjs/feathers/releases/tag/v5.0.40 · Note
• https://t.me/CVEtracker/45342 · Telegram Post
• https://t.me/cveNotify/152692 · Telegram Post
• https://twitter.com/CVEnew/status/2025154198149472739 · Twitter Post
• https://twitter.com/offseq/status/2025065479123902483 · Twitter Post