CVE-2026-27192

Deeper analysis

CVE-2026-27192 affects Feathersjs, a framework for building web APIs and real-time applications using TypeScript or JavaScript, specifically in versions 5.0.39 and earlier. The vulnerability stems from improper origin validation in the getAllowedOrigin() function, which uses the startsWith() method to compare the Referer header against a list of allowed origins. This prefix-based check is insufficient, as it permits bypasses when an attacker registers a domain that shares a common prefix with an allowed origin, such as https://target.com.attacker.com evading validation for https://target.com. The issue is tied to CWE-346 (Origin Validation Error) and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Any remote attacker without privileges can exploit this when the origins array is configured in the application. By controlling a malicious domain with a prefix-matching origin, the attacker can trick the validation into allowing requests from unauthorized sources. While tokens are typically redirected to a configured origin, attackers can initiate an OAuth flow from the malicious origin, exfiltrate authentication tokens, and achieve full account takeover in specific scenarios.

The vulnerability has been fixed in Feathersjs version 5.0.40, as detailed in the project's security advisory (GHSA-mp4x-c34x-wv3x), release notes, and the patching commit (ee19a0ae9bc2ebf23b1fe598a1f7361981b65401). Security practitioners should upgrade to version 5.0.40 or later and review configurations involving origin validation and OAuth flows.