PT-2026-24420 · Unknown · Feathersjs

Sofianeelhor · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-29792

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Feathersjs versions 5.0.0 through 5.0.41

Description Feathersjs is a framework used for building web APIs and real-time applications. An unauthenticated attacker can exploit a flaw in the OAuth callback functionality by sending a specially crafted GET request to the /oauth/:provider/callback API endpoint. The vulnerability arises from a fallback mechanism in the OAuth service's authentication process, which relies on request query parameters (params.query) when Grant's session or state responses are empty. This allows an attacker to forge a profile within the query string and obtain a valid access token for an existing user without interacting with the OAuth provider. The vulnerability occurs because the attacker never initiates an OAuth authorize flow, resulting in an empty Grant session and triggering the fallback mechanism.

Recommendations Update Feathersjs to version 5.0.42 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-29792

GHSA-WG9X-QFGW-PXHJ

Affected Products

Feathersjs

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29792.json · Exploit
• https://github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29792 · Security Note
• https://osv.dev/vulnerability/GHSA-wg9x-qfgw-pxhj · Vendor Advisory
• https://github.com/feathersjs/feathers · Note
• https://twitter.com/0dayPublishing/status/2031466140392710421 · Twitter Post
• https://twitter.com/CVEnew/status/2031504132654121321 · Twitter Post